@memberjunction/server 6.1.4 → 6.1.5

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -3,7 +3,7 @@
 // bring it in automatically — this line MUST precede any import that pulls in the resolver file.
 import 'reflect-metadata';
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 // --- Mock CanRun authorization (AIAgentPermissionHelper.HasPermission) plus the
 //     provider-scoped AIEngineBase whose cached metadata serves the resolver's pairing-row
@@ -210,9 +210,23 @@ interface FakeSession {
     NewRecord: () => void;
     Save: () => Promise<boolean>;
     Load: (id: string) => Promise<boolean>;
-    LatestResult?: { CompleteMessage?: string };
+    LatestResult?: { CompleteMessage?: string; Success?: boolean };
+    /** Only set on the fakes exercising `describeSaveFailure`'s "no failure detail recorded" branches. */
+    ResultHistory?: unknown[];
 }
 
+/**
+ * A `console.error` spy shared by the save-failure-log tests (#4791) below. Assigned with
+ * `vi.spyOn(console, 'error').mockImplementation(() => undefined)` inside each test that needs it
+ * — restored here so no test leaks a mocked `console.error` into the ones after it.
+ */
+let errSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+afterEach(() => {
+    errSpy?.mockRestore();
+    errSpy = undefined;
+});
+
 function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     return {
         ID: 'session-1',
@@ -848,6 +862,28 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
             resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'x', '{}', makeCtx(), makePubSub()),
         ).rejects.toThrow(/no target agent configured/i);
     });
+
+    it('logs the session id and "no failure detail recorded" when updatePendingFeedbackRunID\'s save is refused silently (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const session = makeSessionEntity({
+            Config_: JSON.stringify({ targetAgentID: 'target-1' }),
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeProvider(() => session);
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":1}', Success: true, PausedRunID: 'paused-1' });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('updatePendingFeedbackRunID'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('session-1');
+        expect(failureLine).toContain('no failure detail recorded');
+        expect(failureLine).not.toContain('unknown error');
+    });
 });
 
 describe('RealtimeClientSessionResolver.RelayRealtimeTranscript', () => {
@@ -1690,6 +1726,7 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
     });
 
     it('returns a structured failure when the artifact header save fails (no version attempted)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingArtifact = makeSessionEntity({
             ID: 'artifact-fail',
             Save: vi.fn(async () => false),
@@ -1706,10 +1743,14 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
 
         expect(result.Success).toBe(false);
         expect(result.ErrorMessage).toMatch(/artifact save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('db down');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(version.Save).not.toHaveBeenCalled();
     });
 
     it('returns a structured failure (carrying the orphaned ArtifactID) when the version save fails', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingVersion = makeSessionEntity({
             ID: 'version-fail',
             Save: vi.fn(async () => false),
@@ -1728,6 +1769,10 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
         expect(result.Success).toBe(false);
         expect(result.ArtifactID).toBe('artifact-1');
         expect(result.ArtifactVersionID).toBeUndefined();
+        expect(result.ErrorMessage).toMatch(/artifact version save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('too big');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(junction.Save).not.toHaveBeenCalled();
     });
 
@@ -2880,6 +2925,44 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(executeRelayedToolMock.mock.calls[0][1]).toBe(ANON_USER);
     });
 
+    it('writes the hidden direct-action tool turn (ExecuteRealtimeSessionTool) as the CALLER, not the system user (#4791)', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) =>
+                name === 'MJ: Conversation Details' ? detail : makeSessionEntity({ UserID: 'anon-1' }),
+            ),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        // The dispatch itself still runs elevated (SYSTEM_USER)…
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        // …but the hidden Conversation Detail turn is written as the CALLER, never the system user.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+        expect(detail.Save).toHaveBeenCalled();
+        expect(detail.UserID).toBe('anon-1');
+    });
+
+    it('writes the direct-action tool turn as the caller unchanged for a normal authenticated user', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-2' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: Conversation Details' ? detail : makeSessionEntity())),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', USER);
+    });
+
     it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
@@ -2942,6 +3025,32 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
     });
 
+    it('writes the hidden co-agent tool turn (RelayRealtimeToolTurn) as the CALLER (#4791)', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const detail = makeSessionEntity({ ID: 'detail-3' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
+
+        expect(ok).toBe(true);
+        // The co-agent run mirror stays SYSTEM…
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        // …but the hidden Conversation Detail tool-turn is written as the CALLER, never SYSTEM.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+    });
+
     it('prepares the session with observability under the SYSTEM user while UserID stays the visitor', async () => {
         hasPermissionMock.mockResolvedValue(true);
         currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
@@ -3003,6 +3112,10 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         // The junction write (an entity the anon role does NOT hold) runs as the SYSTEM user.
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Detail Artifacts', SYSTEM_USER);
         expect(junctions).toHaveLength(1);
+        // The hidden anchor `Conversation Detail` is written as the CALLER (#4791) — like every
+        // other `MJ: Conversation Details` write, the System user is refused as not the owner.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
         // The hidden anchor is attributed to the SESSION owner, not the elevated principal.
         expect(anchors).toHaveLength(1);
         expect(anchors[0].UserID).toBe('anon-1');
@@ -3102,6 +3215,107 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(USER);
         expect(getSystemUserMock).not.toHaveBeenCalled();
     });
+
+    /** Provider routing a hidden-tool-turn RelayRealtimeToolTurn call: session, prompt run, detail. */
+    function makeToolTurnProvider(detail: FakeSession): unknown {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        return {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+    }
+
+    it('logs the session id, write user id and "no failure detail recorded" when a hidden tool turn save is refused without a LatestResult (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        // Exact substrings: 'anon-1' alone is the caller, session.UserID AND detail.UserID at once,
+        // so only the labelled form proves the WRITE user is what got logged.
+        expect(failureLine).toContain('session session-1');
+        expect(failureLine).toContain('write user anon-1');
+        expect(failureLine).toContain('no failure detail recorded (LatestResult null; ResultHistory length 0)');
+        expect(failureLine).toContain('the write was refused before reaching the provider');
+        expect(failureLine).not.toContain('unknown error');
+    });
+
+    it('does not claim WHERE the write was refused when a result was registered with an empty message (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: false, CompleteMessage: '   ' },
+            ResultHistory: [{}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('no failure detail recorded (LatestResult empty; ResultHistory length 1)');
+        expect(failureLine).not.toContain('refused before reaching the provider');
+    });
+
+    it('never logs a PRIOR SUCCESS entry\'s text as the failure reason when the refusal registered nothing (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: true, CompleteMessage: 'previous save ok' },
+            ResultHistory: [{}, {}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain(
+            'no failure detail recorded (latest result entry is a prior success; ResultHistory length 2)',
+        );
+        expect(failureLine).not.toContain('previous save ok');
+    });
+
+    it('logs the real CompleteMessage when present (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { CompleteMessage: 'You do not have access to this conversation.' },
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('You do not have access to this conversation.');
+    });
 });
 
 describe('RealtimeClientSessionResolver — colleague authorization (allowedAgents)', () => {

package/src/__tests__/TaskGraphActionRunner.durablePayload.test.ts

@@ -0,0 +1,129 @@
+/**
+ * End-to-end-in-miniature regression test for #4794.
+ *
+ * The bug: `BuildDurableDeferral` persisted a durable entity action's redacted params as a
+ * `LoggedParam[]` ARRAY (`RedactParamsToJSON`'s shape), while `TaskGraphActionRunner.buildParams`
+ * reads `Task.InputPayload` back as a name→value RECORD. Every released build with durable dispatch
+ * (v6.1.0 onward, including 6.1.4) hit the same real-world failure: `TaskGraphDispatcher`'s
+ * `mergedPayload` only merges plain objects, so it silently dropped the array before `buildParams`
+ * ever saw it, and the action ran with NONE of its declared inputs. `buildParams` itself has no such
+ * guard — `Object.assign(merged, arrayValue)` treats an array's indices as keys — so params named
+ * `'0'`, `'1'`, ... would only appear if the array reached it directly, bypassing the dispatcher's
+ * drop. That narrower path is exactly what this test exercises, by calling `RunActionForTask`
+ * on its own rather than through the dispatcher.
+ *
+ * This test proves the whole pipe, not just the writer or the reader in isolation: build the
+ * payload exactly as the deferral does (`RedactParamsToRecord`), push it through the same
+ * `JSON.stringify` / `JSON.parse` round trip `TaskGraphService` performs to persist and reload
+ * `Task.InputPayload`, then run it through the real `TaskGraphActionRunner` and assert the action
+ * receives its declared parameters BY NAME.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/actions', () => ({
+    ActionEngineServer: {
+        Instance: {
+            Config: vi.fn(),
+            Actions: [{ ID: 'A1', Name: 'Log Activity' }],
+            RunAction: vi.fn(),
+        },
+    },
+}));
+
+import { ActionEngineServer } from '@memberjunction/actions';
+import { RedactParamsToRecord, ActionParam } from '@memberjunction/actions-base';
+import type { MJActionExecutionLogEntity, MJActionParamEntity, MJEntityActionParamEntity } from '@memberjunction/core-entities';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { TaskActionRunParams } from '@memberjunction/task-graph';
+import { TaskGraphActionRunner } from '../services/TaskGraphActionRunner';
+
+// ── Test fixture builders — same shape as packages/Actions/Base/src/__tests__/ParamRedaction.test.ts ──
+
+function actionParam(name: string, value: unknown): ActionParam {
+    return { Name: name, Value: value, Type: 'Input' } as ActionParam;
+}
+
+function definition(id: string, name: string, logValue: boolean = true): MJActionParamEntity {
+    return { ID: id, Name: name, LogValue: logValue } as MJActionParamEntity;
+}
+
+function binding(actionParamID: string, valueType: string, logValue: boolean | null = null): MJEntityActionParamEntity {
+    return { ActionParamID: actionParamID, ValueType: valueType, LogValue: logValue } as MJEntityActionParamEntity;
+}
+
+// The declared parameters for the durable entity action under test: three that log normally, and
+// one ("InternalNotes") whose binding opts out of logging (rule 2 in ParamRedaction.ts).
+const RUNTIME_PARAMS: ActionParam[] = [
+    actionParam('TypeCode', 'SystemEvent'),
+    actionParam('Title', 'Person created'),
+    actionParam('RecordID', 'REC-123'),
+    actionParam('InternalNotes', 'do not persist this'),
+];
+const ACTION_PARAMS: MJActionParamEntity[] = [
+    definition('p1', 'TypeCode'),
+    definition('p2', 'Title'),
+    definition('p3', 'RecordID'),
+    definition('p4', 'InternalNotes'),
+];
+const ENTITY_ACTION_PARAMS: MJEntityActionParamEntity[] = [binding('p4', 'Static', false)];
+
+function baseRunParams(inputPayload: unknown): TaskActionRunParams {
+    return {
+        TaskID: 'T1',
+        ActionID: 'A1',
+        InputPayload: inputPayload,
+        DependencyOutputs: new Map(),
+        Provider: {} as IMetadataProvider,
+        ContextUser: {} as UserInfo,
+    };
+}
+
+describe('TaskGraphActionRunner — durable payload round-trips by param name (#4794)', () => {
+    beforeEach(() => {
+        // vitest's `restoreMocks: true` clears mock implementations before every test, including
+        // the ones assigned inside the `vi.mock` factory above — so the return value is (re)armed here.
+        vi.mocked(ActionEngineServer.Instance.Config).mockResolvedValue(undefined);
+        vi.mocked(ActionEngineServer.Instance.RunAction, { partial: true }).mockResolvedValue({
+            Success: true,
+            Params: [],
+            LogEntry: { ID: 'L1' } as MJActionExecutionLogEntity,
+        });
+    });
+
+    it('delivers RedactParamsToRecord\'s output to the action by name, after a JSON round trip', async () => {
+        // Exactly what the deferral writes, then exactly what TaskGraphService's JSON column does to it.
+        const stored = JSON.parse(JSON.stringify(RedactParamsToRecord(RUNTIME_PARAMS, ACTION_PARAMS, ENTITY_ACTION_PARAMS)));
+
+        const result = await new TaskGraphActionRunner().RunActionForTask(baseRunParams(stored));
+
+        expect(result.Success).toBe(true);
+        expect(result.ActionLogID).toBe('L1');
+
+        const runActionCall = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0];
+        const sentParams = runActionCall.Params as ActionParam[];
+
+        // The three logged declared names arrive, order-insensitive, with their values intact.
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['RecordID', 'Title', 'TypeCode']);
+        expect(sentParams.find((p) => p.Name === 'TypeCode')?.Value).toBe('SystemEvent');
+        expect(sentParams.find((p) => p.Name === 'Title')?.Value).toBe('Person created');
+        expect(sentParams.find((p) => p.Name === 'RecordID')?.Value).toBe('REC-123');
+
+        // The binding-suppressed parameter never reaches the action — absent, not present-with-undefined.
+        expect(sentParams.some((p) => p.Name === 'InternalNotes')).toBe(false);
+    });
+
+    it('does not turn dependency outputs into params named by the upstream task ID', async () => {
+        // The dispatcher keys DependencyOutputs by the upstream task's ID and has ALREADY merged their
+        // values into InputPayload (TaskGraphDispatcher.mergedPayload). A runner that also spread the
+        // map handed the action one extra param per dependency, named by a GUID and holding that
+        // task's whole output — which then landed, unredacted, in ActionExecutionLog.Params.
+        const upstreamID = '20924BD7-5128-4150-8404-FB44A55AEA0F';
+        const params = baseRunParams({ EntityName: 'MJ: Entities', Record: { ID: 'R1', Name: 'MJ: Tags' } });
+        params.DependencyOutputs = new Map([[upstreamID, { Record: { ID: 'R1', Name: 'MJ: Tags' } }]]);
+
+        await new TaskGraphActionRunner().RunActionForTask(params);
+
+        const sentParams = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0].Params as ActionParam[];
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['EntityName', 'Record']);
+    });
+});

package/src/__tests__/adhocTimeoutClamp.test.ts

@@ -0,0 +1,26 @@
+/**
+ * An ad-hoc query's timeout never exceeds the server's requestTimeout, so a caller cannot hold a
+ * read-only connection longer than any other request may.
+ */
+import { describe, it, expect } from 'vitest';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout';
+
+describe('ClampAdhocTimeoutSeconds', () => {
+    it('caps a longer request at requestTimeout', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 30000)).toBe(30);
+    });
+
+    it('keeps a shorter request', () => {
+        expect(ClampAdhocTimeoutSeconds(5, 30000)).toBe(5);
+    });
+
+    it('uses 30 seconds when the caller names none, within the cap', () => {
+        expect(ClampAdhocTimeoutSeconds(undefined, 30000)).toBe(30);
+        expect(ClampAdhocTimeoutSeconds(undefined, 10000)).toBe(10);
+        expect(ClampAdhocTimeoutSeconds(0, 30000)).toBe(30);
+    });
+
+    it('leaves the request alone when the server sets no limit', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 0)).toBe(600);
+    });
+});

package/src/__tests__/magicLink.test.ts

@@ -6,7 +6,7 @@ import {
   hashToken,
   evaluateInvite,
   buildSessionClaims,
-  buildConsumeInviteSQL,
+  buildConsumeInvitePostgresSQL,
   canIssueInvites,
   isRoleGrantable,
   unionScopes,
@@ -168,71 +168,13 @@ describe('magic-link core', () => {
     });
   });
 
-  describe('buildConsumeInviteSQL', () => {
-    const table = '[__mj].[MagicLinkInvite]';
-    const sql = buildConsumeInviteSQL(table);
-
-    it('targets the supplied qualified table', () => {
-      expect(sql).toContain(`UPDATE ${table} `);
-    });
-
-    it('increments UseCount', () => {
-      expect(sql).toContain('UseCount = UseCount + 1');
-    });
-
-    it('stamps ConsumedAt only the first time (COALESCE preserves an existing value)', () => {
-      expect(sql).toContain('ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME())');
-    });
-
-    it('flips Status to Consumed exactly when the last use is taken', () => {
-      expect(sql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
-    });
-
-    it('returns the affected row via OUTPUT INTO a table var so the caller can detect a win (exactly one row)', () => {
-      // Must be OUTPUT ... INTO, not a bare OUTPUT: SQL Server forbids a bare
-      // OUTPUT clause on a table with enabled triggers, and CodeGen adds an
-      // __mj_UpdatedAt trigger to every MJ table. Regression guard for that bug.
-      expect(sql).toContain('OUTPUT INSERTED.ID INTO @consumed');
-      expect(sql).not.toMatch(/OUTPUT INSERTED\.ID(?!\s+INTO)/);
-      expect(sql).toContain('SELECT ID FROM @consumed');
-    });
-
-    it('guards atomically on Active + not-exhausted + not-expired — this IS the single-use gate', () => {
-      const where = sql.slice(sql.indexOf('WHERE'));
-      expect(where).toContain("Status = 'Active'");
-      expect(where).toContain('UseCount < MaxUses');
-      expect(where).toContain('ExpiresAt > SYSUTCDATETIME()');
-    });
-
-    it('binds the invite ID as a parameter, never interpolated (injection-safe)', () => {
-      expect(sql).toContain('ID = @p0');
-      // The id must not be string-interpolated with quotes around a value.
-      expect(sql).not.toMatch(/ID = '/);
-    });
-
-    it('is a self-contained batch: declare table var, update-with-output, select', () => {
-      // Intentionally a 3-statement batch (the OUTPUT-INTO requirement). The ID is
-      // still parameterized, so the batch carries no interpolated user input.
-      expect(sql).toContain('DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER)');
-      expect(sql.match(/;/g)?.length).toBe(3);
-      expect(sql.trim().endsWith(';')).toBe(true);
-    });
-
-    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
-      // Only bracket-quoted [schema].[table] of word chars is accepted, even though
-      // the caller derives the table from EntityInfo and never from user input.
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]; DROP TABLE x;--')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[Magic Link]')).toThrow();
-      expect(() => buildConsumeInviteSQL(table)).not.toThrow();
-    });
-  });
-
-  describe('buildConsumeInviteSQL (postgresql dialect)', () => {
-    // PG uses `schema.table` (unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes
-    // the PascalCase identifiers). SS uses the bracket-quoted `[schema].[table]` form.
+  describe('buildConsumeInvitePostgresSQL', () => {
+    // PostgreSQL only: SQL Server consumes through spConsumeMagicLinkInvite (#4753), but PG has no
+    // such function and its runtime roles hold table DML, so PG keeps this direct guarded UPDATE.
+    // PG uses `schema.table` unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes the
+    // PascalCase identifiers.
     const pgTable = '__mj.MagicLinkInvite';
-    const pgSql = buildConsumeInviteSQL(pgTable, 'postgresql');
+    const pgSql = buildConsumeInvitePostgresSQL(pgTable);
 
     it('targets the supplied unquoted schema.table', () => {
       expect(pgSql).toContain(`UPDATE ${pgTable} `);
@@ -246,35 +188,32 @@ describe('magic-link core', () => {
 
     it('binds the invite ID as PG positional param $1, not T-SQL @p0 (injection-safe)', () => {
       expect(pgSql).toContain('ID = $1');
-      expect(pgSql).not.toContain('@p0');
-      expect(pgSql).not.toMatch(/@/); // no T-SQL @-anything survives on PG
+      expect(pgSql).not.toMatch(/@/);
       expect(pgSql).not.toMatch(/ID = '/);
     });
 
     it('uses PG timestamp expressions, not T-SQL SYSUTCDATETIME()', () => {
       expect(pgSql).not.toContain('SYSUTCDATETIME');
-      expect(pgSql).toContain("(now() AT TIME ZONE 'utc')");
       expect(pgSql).toContain("ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc'))");
     });
 
-    it('guards atomically on Active + not-exhausted + not-expired (same predicate as SS)', () => {
+    it('guards atomically on Active + not-exhausted + not-expired (same predicate as spConsumeMagicLinkInvite)', () => {
       const where = pgSql.slice(pgSql.indexOf('WHERE'));
       expect(where).toContain("Status = 'Active'");
       expect(where).toContain('UseCount < MaxUses');
       expect(where).toContain("ExpiresAt > (now() AT TIME ZONE 'utc')");
     });
 
-    it('increments UseCount and flips Status on the last use (same semantics as SS)', () => {
+    it('increments UseCount and flips Status on the last use (same semantics as spConsumeMagicLinkInvite)', () => {
       expect(pgSql).toContain('UseCount = UseCount + 1');
       expect(pgSql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
     });
 
-    it('rejects a non-whitelisted PG table identifier (defense-in-depth against injection)', () => {
-      // Bracket-quoted (SS) form is not a valid PG identifier here.
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite; DROP TABLE x;--', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.Magic Link', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL(pgTable, 'postgresql')).not.toThrow();
+    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
+      expect(() => buildConsumeInvitePostgresSQL('[__mj].[MagicLinkInvite]')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite; DROP TABLE x;--')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.Magic Link')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL(pgTable)).not.toThrow();
     });
   });