@memberjunction/server 6.1.4 → 6.1.6

package/src/__tests__/ViewOperationsHandler.clauseScreen.test.ts

@@ -0,0 +1,157 @@
+/**
+ * The REST view routes (`POST /views/:entityName`, `POST /views/batch`, `GET /entities/:entityName`)
+ * hand client `ExtraFilter` / `OrderBy` / `OverrideExcludeFilter` text to `RunView` through
+ * `ViewOperationsHandler`. These tests pin that the text passes the same base-view AST screen as
+ * the GraphQL RunView resolvers before any view runs. Payloads are harmless (stacked `SELECT`s);
+ * the point is only whether they reach `RunView`.
+ *
+ * `@memberjunction/core`'s `Metadata` and `RunView` are replaced at the module boundary, as in
+ * ViewOperationsHandler.test.ts; the screen itself runs unmodified.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { mockRunViewFn, mockRunViewsFn, mockEntityList } = vi.hoisted(() => ({
+    mockRunViewFn: vi.fn(),
+    mockRunViewsFn: vi.fn(),
+    mockEntityList: [] as Array<{
+        Name: string;
+        SchemaName: string;
+        BaseView: string;
+        GetUserPermisions: (u: unknown) => { CanRead: boolean };
+        GetEffectiveRowFilterWhereClause: () => string;
+        GetDeniedReadFields: () => Set<string>;
+    }>,
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockMetadata {
+        public get Entities() {
+            return mockEntityList;
+        }
+    }
+    class MockRunView {
+        public RunView(params: unknown, contextUser?: unknown): Promise<unknown> {
+            return mockRunViewFn(params, contextUser);
+        }
+        public RunViews(params: unknown[], contextUser?: unknown): Promise<unknown> {
+            return mockRunViewsFn(params, contextUser);
+        }
+    }
+    return { ...actual, Metadata: MockMetadata, RunView: MockRunView, LogError: vi.fn() };
+});
+
+import type { BaseEntity, PlatformSQL, RunViewParams, UserInfo } from '@memberjunction/core';
+import { ViewOperationsHandler } from '../rest/ViewOperationsHandler.js';
+
+const BRACKET_STACKED =
+    "1 = (SELECT 1 AS [a'])) ; SELECT 1 AS [x] ; SELECT * FROM sales.vwCustomers WHERE (1 = (SELECT 1 AS [b'])";
+
+const USER = { ID: 'user-1', Name: 'Reader' } as unknown as UserInfo;
+const OK_RESULT = { Success: true, Results: [{ ID: '1' }] };
+
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockEntityList.length = 0;
+    const unscoped = { GetEffectiveRowFilterWhereClause: () => '', GetDeniedReadFields: () => new Set<string>() };
+    mockEntityList.push(
+        { Name: 'Customers', SchemaName: 'sales', BaseView: 'vwCustomers', GetUserPermisions: () => ({ CanRead: true }), ...unscoped },
+        { Name: 'Ledger', SchemaName: 'sales', BaseView: 'vwLedger', GetUserPermisions: () => ({ CanRead: false }), ...unscoped },
+        {
+            Name: 'Orders',
+            SchemaName: 'sales',
+            BaseView: 'vwOrders',
+            GetUserPermisions: () => ({ CanRead: true }),
+            GetEffectiveRowFilterWhereClause: () => "(OwnerID = 'user-1')",
+            GetDeniedReadFields: () => new Set<string>(),
+        },
+    );
+    mockRunViewFn.mockResolvedValue(OK_RESULT);
+    mockRunViewsFn.mockResolvedValue([OK_RESULT]);
+});
+
+describe('ViewOperationsHandler — REST clause screen', () => {
+    it('RunView refuses a stacked statement hidden behind a bracket identifier, before RunView', async () => {
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/Invalid ExtraFilter: multiple statements/);
+    });
+
+    it('RunView screens OrderBy and OverrideExcludeFilter too', async () => {
+        const cases: RunViewParams[] = [
+            { EntityName: 'Customers', OrderBy: "[a'] ; SELECT 1 AS [x] ; SELECT 1 AS [b']" },
+            { EntityName: 'Customers', OverrideExcludeFilter: BRACKET_STACKED },
+        ];
+        for (const params of cases) {
+            const outcome = await ViewOperationsHandler.runView(params, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery against a base table or an entity the caller cannot read', async () => {
+        for (const filter of [
+            `EXISTS (SELECT 1 FROM __mj.[User] WHERE [Type] = 'Owner')`,
+            `ID IN (SELECT CustomerID FROM sales.vwLedger)`,
+        ]) {
+            const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+            expect(outcome.success).toBe(false);
+        }
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('RunView refuses a subquery over an entity that is row-level-security filtered for the caller', async () => {
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: `ID IN (SELECT CustomerID FROM sales.vwOrders)` }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/'Orders' is row-level-security filtered for you/);
+    });
+
+    it('RunView screens every variant of a platform-specific filter', async () => {
+        const filter: PlatformSQL = { default: `Name = 'x'`, sqlserver: BRACKET_STACKED };
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('RunViews refuses the whole batch when one entry carries a payload', async () => {
+        const outcome = await ViewOperationsHandler.runViews(
+            [{ EntityName: 'Customers' }, { EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }],
+            USER,
+        );
+
+        expect(mockRunViewsFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+    });
+
+    it('ListEntities refuses a payload in the query-string filter', async () => {
+        await expect(
+            ViewOperationsHandler.listEntities({ EntityName: 'Customers', ExtraFilter: BRACKET_STACKED }, USER),
+        ).rejects.toThrow(/multiple statements/);
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('refuses a ViewEntity that was not loaded as an entity (its ID would be spliced into SQL)', async () => {
+        const forged = { ID: '0) ; SELECT 1 AS [x] ; SELECT 1 WHERE (1=1', EntityID: 'any' } as unknown as BaseEntity;
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ViewEntity: forged, ExcludeDataFromAllPriorViewRuns: true }, USER);
+
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+        expect(outcome.success).toBe(false);
+        expect(outcome.error).toMatch(/ViewEntity is not accepted over REST/);
+    });
+
+    it('passes a filter that only reads entity base views through to RunView', async () => {
+        const filter = `Name = 'O''Brien' AND ID IN (SELECT ID FROM sales.vwCustomers WHERE Region = 'West')`;
+
+        const outcome = await ViewOperationsHandler.runView({ EntityName: 'Customers', ExtraFilter: filter, OrderBy: '[Name] DESC' }, USER);
+
+        expect(outcome.success).toBe(true);
+        expect((mockRunViewFn.mock.calls[0][0] as RunViewParams).ExtraFilter).toBe(filter);
+    });
+});

package/src/__tests__/actionAuthorization.test.ts

@@ -0,0 +1,130 @@
+/**
+ * The policy that decides who may run an action through a public entry point. It reads the
+ * `MJ: Action Authorizations` rows for the action, the caller's roles, one provider's authorizations
+ * and role grants, and whether the action's class authorizes its caller itself. It fails closed: an
+ * action that no authorization grants, and whose class does not authorize its caller, runs for
+ * Owners only.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { AuthorizationInfo, AuthorizationRoleInfo, Metadata, UserInfo, UserRoleInfo } from '@memberjunction/core';
+import { EvaluateActionRunAuthorization, IsOwner, type AuthorizationMetadata } from '../auth/actionAuthorization.js';
+
+const ANALYST_ROLE = 'A11C0000-0000-4000-8000-0000000000F1';
+const AUDITOR_ROLE = 'A11C0000-0000-4000-8000-0000000000F2';
+const BLOCKED_ROLE = 'A11C0000-0000-4000-8000-0000000000F3';
+
+const DATA_TOOLS = new AuthorizationInfo({ ID: 'auth-data-tools', Name: 'Data Tools', IsActive: true });
+const RUN_QUERIES = new AuthorizationInfo({ ID: 'auth-run-queries', Name: 'Run Queries', IsActive: true, ParentID: DATA_TOOLS.ID });
+const RETIRED_TOOL = new AuthorizationInfo({ ID: 'auth-retired-tool', Name: 'Retired Tool', IsActive: false, ParentID: DATA_TOOLS.ID });
+const SWITCHED_OFF = new AuthorizationInfo({ ID: 'auth-switched-off', Name: 'Switched Off', IsActive: false });
+const AUTHORIZATIONS = [DATA_TOOLS, RUN_QUERIES, RETIRED_TOOL, SWITCHED_OFF];
+const AUTHORIZATION_ROLES = [
+    new AuthorizationRoleInfo({ ID: 'ar-1', AuthorizationID: RUN_QUERIES.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-2', AuthorizationID: DATA_TOOLS.ID, RoleID: AUDITOR_ROLE, Type: 'Allow' }),
+    new AuthorizationRoleInfo({ ID: 'ar-3', AuthorizationID: RUN_QUERIES.ID, RoleID: BLOCKED_ROLE, Type: 'Deny' }),
+    new AuthorizationRoleInfo({ ID: 'ar-4', AuthorizationID: SWITCHED_OFF.ID, RoleID: ANALYST_ROLE, Type: 'Allow' }),
+];
+/** The provider metadata the decision reads. */
+const METADATA: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: AUTHORIZATION_ROLES };
+
+const user = (type: string, roleIDs: string[]): UserInfo =>
+    new UserInfo(null, { ID: `user-${type}-${roleIDs.join('-')}`, Type: type, UserRoles: roleIDs.map((RoleID) => new UserRoleInfo({ RoleID })) });
+
+/** Decides for an action whose class does not authorize its caller. */
+const decide = (caller: UserInfo, linkedAuthorizationIDs: string[]) =>
+    EvaluateActionRunAuthorization(caller, linkedAuthorizationIDs, METADATA, false);
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    // The decision reads only the metadata it is given, so any read of the global provider fails the test.
+    vi.spyOn(Metadata, 'Provider', 'get').mockImplementation(() => {
+        throw new Error('The decision read the global metadata provider');
+    });
+});
+
+describe('IsOwner', () => {
+    it('recognises the Owner type, padded as the nchar column stores it', () => {
+        expect(IsOwner(user('Owner     ', []))).toBe(true);
+        expect(IsOwner(user('User', [ANALYST_ROLE]))).toBe(false);
+    });
+});
+
+describe('EvaluateActionRunAuthorization', () => {
+    describe('Owners', () => {
+        it('lets an Owner run any action, linked or not', () => {
+            expect(decide(user('Owner     ', []), []).Allowed).toBe(true);
+            expect(decide(user('Owner     ', []), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with no Action Authorization rows', () => {
+        it('is refused to any other user when its class does not authorize its caller', () => {
+            const decision = decide(user('User', [ANALYST_ROLE]), []);
+
+            expect(decision.Allowed).toBe(false);
+            expect(decision.Reason).toMatch(/no action authorization/i);
+        });
+
+        it('runs for any user when its class authorizes its caller, so the action\'s own check decides', () => {
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [], METADATA, true).Allowed).toBe(true);
+        });
+    });
+
+    describe('an action with Action Authorization rows', () => {
+        it('is decided by its links, even when its class authorizes its caller', () => {
+            expect(EvaluateActionRunAuthorization(user('User', ['some-other-role']), [RUN_QUERIES.ID], METADATA, true).Allowed).toBe(false);
+        });
+
+        it('runs for a user whose role holds a linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('runs for a user whose role holds an ancestor of a linked authorization', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+        });
+
+        it('is refused to a user whose roles hold none of the linked authorizations', () => {
+            expect(decide(user('User', ['some-other-role']), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [SWITCHED_OFF.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when the linked authorization is inactive, even to a holder of its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE]), [RETIRED_TOOL.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when one of the user\'s roles is denied the linked authorization', () => {
+            expect(decide(user('User', [ANALYST_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('is refused when a role is denied the linked authorization, even if another role holds its parent', () => {
+            expect(decide(user('User', [AUDITOR_ROLE, BLOCKED_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(false);
+        });
+
+        it('ignores a linked authorization that no longer exists in metadata', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), ['auth-deleted']).Allowed).toBe(false);
+        });
+
+        it('matches authorization IDs regardless of case', () => {
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID.toUpperCase()]).Allowed).toBe(true);
+        });
+    });
+
+    describe('the metadata it reads', () => {
+        it('decides from the role grants it is given, never from the global provider', () => {
+            const sameTreeWithoutGrants: AuthorizationMetadata = { Authorizations: AUTHORIZATIONS, AuthorizationRoles: [] };
+
+            expect(decide(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [ANALYST_ROLE]), [RUN_QUERIES.ID], sameTreeWithoutGrants, false).Allowed).toBe(false);
+        });
+
+        it('walks to the parent within the authorizations it is given', () => {
+            const treeWithoutParent: AuthorizationMetadata = { Authorizations: [RUN_QUERIES], AuthorizationRoles: AUTHORIZATION_ROLES };
+
+            expect(decide(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID]).Allowed).toBe(true);
+            expect(EvaluateActionRunAuthorization(user('User', [AUDITOR_ROLE]), [RUN_QUERIES.ID], treeWithoutParent, false).Allowed).toBe(false);
+        });
+    });
+});

package/src/__tests__/adhocTimeoutClamp.test.ts

@@ -0,0 +1,26 @@
+/**
+ * An ad-hoc query's timeout never exceeds the server's requestTimeout, so a caller cannot hold a
+ * read-only connection longer than any other request may.
+ */
+import { describe, it, expect } from 'vitest';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout';
+
+describe('ClampAdhocTimeoutSeconds', () => {
+    it('caps a longer request at requestTimeout', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 30000)).toBe(30);
+    });
+
+    it('keeps a shorter request', () => {
+        expect(ClampAdhocTimeoutSeconds(5, 30000)).toBe(5);
+    });
+
+    it('uses 30 seconds when the caller names none, within the cap', () => {
+        expect(ClampAdhocTimeoutSeconds(undefined, 30000)).toBe(30);
+        expect(ClampAdhocTimeoutSeconds(undefined, 10000)).toBe(10);
+        expect(ClampAdhocTimeoutSeconds(0, 30000)).toBe(30);
+    });
+
+    it('leaves the request alone when the server sets no limit', () => {
+        expect(ClampAdhocTimeoutSeconds(600, 0)).toBe(600);
+    });
+});

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -5,6 +5,8 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
   ConfigureRecordDataBroadcast,
   MayBroadcastRecordData,
+  ReadIsRowFiltered,
+  ShapeCacheInvalidationEvent,
 } from '../generic/CacheInvalidationResolver.js';
 
 /**
@@ -175,3 +177,65 @@ describe('cacheInvalidationFilter', () => {
     expect(filter({ payload: { ...event(''), entityName: '' } as never, context: session({ ID: 'u1' }) })).toBe(false);
   });
 });
+
+/**
+ * Row-level narrowing (MJ#5241): a subscriber who reads the entity only through a row-level security filter learns that a
+ * row changed, not which one; a subscriber with an unfiltered read keeps the key; a subscriber with no read is the entity-level
+ * filter's business and gets nothing here to shape.
+ */
+describe('ReadIsRowFiltered and ShapeCacheInvalidationEvent', () => {
+  const FILTERED_ROLE = 'role-participant';
+  const OPEN_ROLE = 'role-staff';
+  const entity = {
+    Permissions: [
+      { RoleID: FILTERED_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: 'filter-1' },
+      { RoleID: OPEN_ROLE, CanRead: true, Type: 'Allow', ReadRLSFilterID: null },
+      { RoleID: 'role-denied', CanRead: true, Type: 'Deny', ReadRLSFilterID: null },
+    ],
+  };
+  const payload = {
+    entityName: 'Spaces',
+    primaryKeyValues: 'ID|abc',
+    action: 'save',
+    sourceServerId: 'srv',
+    timestamp: new Date('2026-10-07T00:00:00Z'),
+    originSessionId: 'sess',
+    recordData: '{"Name":"x"}',
+  };
+
+  it('is row-filtered when every read the user holds carries a filter', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }] })).toBe(true);
+  });
+
+  it('is not row-filtered when any read the user holds is unfiltered, whichever role brings it', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: OPEN_ROLE }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: FILTERED_ROLE }, { RoleID: OPEN_ROLE }] })).toBe(false);
+  });
+
+  it('is not row-filtered when the user holds no read at all (the entity-level filter owns that case), and a Deny row grants nothing', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-stranger' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: 'role-denied' }] })).toBe(false);
+    expect(ReadIsRowFiltered(entity, { UserRoles: null })).toBe(false);
+  });
+
+  it('matches role ids without regard to case or whitespace', () => {
+    expect(ReadIsRowFiltered(entity, { UserRoles: [{ RoleID: ` ${FILTERED_ROLE.toUpperCase()} ` }] })).toBe(true);
+  });
+
+  it('withholds the key and the row from a row-filtered subscriber, and keeps the rest of the event', () => {
+    const shaped = ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, entity);
+    expect(shaped.PrimaryKeyValues).toBeUndefined();
+    expect(shaped.RecordData).toBeUndefined();
+    expect(shaped.EntityName).toBe('Spaces');
+    expect(shaped.Action).toBe('save');
+    expect(shaped.SourceServerID).toBe('srv');
+    expect(shaped.OriginSessionID).toBe('sess');
+  });
+
+  it('delivers the event whole to an unfiltered reader, and when the entity or the user is unknown', () => {
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: OPEN_ROLE }] }, entity).RecordData).toBe('{"Name":"x"}');
+    expect(ShapeCacheInvalidationEvent(payload, { UserRoles: [{ RoleID: FILTERED_ROLE }] }, null).PrimaryKeyValues).toBe('ID|abc');
+    expect(ShapeCacheInvalidationEvent(payload, undefined, entity).PrimaryKeyValues).toBe('ID|abc');
+  });
+});

package/src/__tests__/isolatedProviderTransactions.test.ts

@@ -0,0 +1,169 @@
+/**
+ * Transactions opened outside a GraphQL request run on their OWN provider, never the shared
+ * `Metadata.Provider`.
+ *
+ * A provider's ambient transaction is per INSTANCE, and the global provider is shared by every
+ * request, scheduled job and background service. A transaction opened there nests into any other
+ * caller's, and while it is open every global-provider write from anywhere lands inside it. One left
+ * open swallows them all until the process restarts (MJ#2140). These tests pin the two call sites
+ * that used to open their transaction on the global provider: magic-link provisioning and
+ * SyncData's delete-with-filter. New-user creation is pinned in newUsers.test.ts.
+ */
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+
+const factory = vi.hoisted(() => ({ create: vi.fn() }));
+vi.mock('../isolatedProvider.js', () => ({ CreateIsolatedProvider: factory.create }));
+
+import { Metadata, RunView, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { SyncDataResolver, type ActionItemOutputType } from '../resolvers/SyncDataResolver.js';
+
+/** A provider that records every call made on it. */
+function recordingProvider(calls: string[], saveSucceeds = true) {
+  return {
+    BeginTransaction: vi.fn(async () => { calls.push('BeginTransaction'); }),
+    CommitTransaction: vi.fn(async () => { calls.push('CommitTransaction'); }),
+    RollbackTransaction: vi.fn(async () => { calls.push('RollbackTransaction'); }),
+    GetEntityObject: vi.fn(async (entityName: string) => {
+      calls.push(`GetEntityObject:${entityName}`);
+      const entity: Record<string, unknown> = {
+        NewRecord: () => { entity.ID = `id-${entityName}`; },
+        Save: async () => saveSucceeds,
+        GetAll: () => ({ ID: entity.ID }),
+        LatestResult: { CompleteMessage: 'save failed' },
+      };
+      return entity;
+    }),
+  };
+}
+
+let globalCalls: string[];
+let isolatedCalls: string[];
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => undefined);
+  vi.spyOn(console, 'error').mockImplementation(() => undefined);
+  globalCalls = [];
+  isolatedCalls = [];
+  Metadata.Provider = recordingProvider(globalCalls) as unknown as IMetadataProvider;
+});
+
+afterEach(() => {
+  Metadata.Provider = null as unknown as IMetadataProvider;
+  vi.restoreAllMocks();
+  factory.create.mockReset();
+});
+
+describe('MagicLinkService.createScopedUser', () => {
+  const invite = { Email: 'guest@example.com', RoleID: 'role-1', ApplicationID: 'app-1' } as unknown as MJMagicLinkInviteEntity;
+  const role = { ID: 'role-1', Name: 'External Guest' } as RoleInfo;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const provision = () =>
+    new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig)['createScopedUser'](invite, role, contextUser);
+
+  it('provisions inside a transaction on its own provider', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+
+    expect((await provision()).success).toBe(true);
+    expect(isolatedCalls).toEqual([
+      'BeginTransaction',
+      'GetEntityObject:MJ: Users',
+      'GetEntityObject:MJ: User Roles',
+      'GetEntityObject:MJ: User Applications',
+      'CommitTransaction',
+    ]);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on its own provider when a save fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls, false));
+
+    expect((await provision()).success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'GetEntityObject:MJ: Users', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});
+
+describe('SyncDataResolver.SyncSingleItemDeleteWithFilter', () => {
+  const user = { ID: 'system' } as UserInfo;
+
+  /** Rows the filtered view returns; each records its Delete on the shared call log. */
+  function stubView(rows: number, deleteSucceeds = true) {
+    const fromProvider = vi.spyOn(RunView, 'FromMetadataProvider').mockImplementation(
+      () =>
+        ({
+          RunView: async () => ({
+            Success: true,
+            Results: Array.from({ length: rows }, (_, i) => ({
+              Delete: async () => { isolatedCalls.push(`Delete:${i}`); return deleteSucceeds; },
+              LatestResult: { CompleteMessage: 'delete failed' },
+            })),
+          }),
+        }) as unknown as RunView,
+    );
+    return fromProvider;
+  }
+
+  const deleteWithFilter = (providerOverride?: IMetadataProvider) => {
+    const result = { Success: false } as ActionItemOutputType;
+    const resolver = new SyncDataResolver() as unknown as {
+      SyncSingleItemDeleteWithFilter: (...args: unknown[]) => Promise<void>;
+    };
+    return resolver
+      .SyncSingleItemDeleteWithFilter('MJ: Things', "Name = 'x'", result, user, {}, providerOverride)
+      .then(() => result);
+  };
+
+  it('with no request provider, loads AND deletes on its own provider inside one transaction', async () => {
+    const isolated = recordingProvider(isolatedCalls);
+    factory.create.mockResolvedValue(isolated);
+    const fromProvider = stubView(2);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(true);
+    expect(fromProvider).toHaveBeenCalledWith(isolated);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'Delete:1', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('with a request provider, uses it for both the read and the transaction', async () => {
+    const requestProvider = recordingProvider(isolatedCalls);
+    const fromProvider = stubView(1);
+
+    const result = await deleteWithFilter(requestProvider as unknown as IMetadataProvider);
+
+    expect(result.Success).toBe(true);
+    expect(factory.create).not.toHaveBeenCalled();
+    expect(fromProvider).toHaveBeenCalledWith(requestProvider);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'CommitTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+
+  it('rolls back on the same provider when a delete fails', async () => {
+    factory.create.mockResolvedValue(recordingProvider(isolatedCalls));
+    stubView(2, false);
+
+    const result = await deleteWithFilter();
+
+    expect(result.Success).toBe(false);
+    expect(isolatedCalls).toEqual(['BeginTransaction', 'Delete:0', 'RollbackTransaction']);
+    expect(globalCalls).toEqual([]);
+  });
+});