@memberjunction/server 6.1.4 → 6.1.6

package/src/__tests__/magicLink.test.ts

@@ -6,7 +6,7 @@ import {
   hashToken,
   evaluateInvite,
   buildSessionClaims,
-  buildConsumeInviteSQL,
+  buildConsumeInvitePostgresSQL,
   canIssueInvites,
   isRoleGrantable,
   unionScopes,
@@ -168,71 +168,13 @@ describe('magic-link core', () => {
     });
   });
 
-  describe('buildConsumeInviteSQL', () => {
-    const table = '[__mj].[MagicLinkInvite]';
-    const sql = buildConsumeInviteSQL(table);
-
-    it('targets the supplied qualified table', () => {
-      expect(sql).toContain(`UPDATE ${table} `);
-    });
-
-    it('increments UseCount', () => {
-      expect(sql).toContain('UseCount = UseCount + 1');
-    });
-
-    it('stamps ConsumedAt only the first time (COALESCE preserves an existing value)', () => {
-      expect(sql).toContain('ConsumedAt = COALESCE(ConsumedAt, SYSUTCDATETIME())');
-    });
-
-    it('flips Status to Consumed exactly when the last use is taken', () => {
-      expect(sql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
-    });
-
-    it('returns the affected row via OUTPUT INTO a table var so the caller can detect a win (exactly one row)', () => {
-      // Must be OUTPUT ... INTO, not a bare OUTPUT: SQL Server forbids a bare
-      // OUTPUT clause on a table with enabled triggers, and CodeGen adds an
-      // __mj_UpdatedAt trigger to every MJ table. Regression guard for that bug.
-      expect(sql).toContain('OUTPUT INSERTED.ID INTO @consumed');
-      expect(sql).not.toMatch(/OUTPUT INSERTED\.ID(?!\s+INTO)/);
-      expect(sql).toContain('SELECT ID FROM @consumed');
-    });
-
-    it('guards atomically on Active + not-exhausted + not-expired — this IS the single-use gate', () => {
-      const where = sql.slice(sql.indexOf('WHERE'));
-      expect(where).toContain("Status = 'Active'");
-      expect(where).toContain('UseCount < MaxUses');
-      expect(where).toContain('ExpiresAt > SYSUTCDATETIME()');
-    });
-
-    it('binds the invite ID as a parameter, never interpolated (injection-safe)', () => {
-      expect(sql).toContain('ID = @p0');
-      // The id must not be string-interpolated with quotes around a value.
-      expect(sql).not.toMatch(/ID = '/);
-    });
-
-    it('is a self-contained batch: declare table var, update-with-output, select', () => {
-      // Intentionally a 3-statement batch (the OUTPUT-INTO requirement). The ID is
-      // still parameterized, so the batch carries no interpolated user input.
-      expect(sql).toContain('DECLARE @consumed TABLE (ID UNIQUEIDENTIFIER)');
-      expect(sql.match(/;/g)?.length).toBe(3);
-      expect(sql.trim().endsWith(';')).toBe(true);
-    });
-
-    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
-      // Only bracket-quoted [schema].[table] of word chars is accepted, even though
-      // the caller derives the table from EntityInfo and never from user input.
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]; DROP TABLE x;--')).toThrow();
-      expect(() => buildConsumeInviteSQL('[__mj].[Magic Link]')).toThrow();
-      expect(() => buildConsumeInviteSQL(table)).not.toThrow();
-    });
-  });
-
-  describe('buildConsumeInviteSQL (postgresql dialect)', () => {
-    // PG uses `schema.table` (unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes
-    // the PascalCase identifiers). SS uses the bracket-quoted `[schema].[table]` form.
+  describe('buildConsumeInvitePostgresSQL', () => {
+    // PostgreSQL only: SQL Server consumes through spConsumeMagicLinkInvite (#4753), but PG has no
+    // such function and its runtime roles hold table DML, so PG keeps this direct guarded UPDATE.
+    // PG uses `schema.table` unquoted — PostgreSQLDataProvider.ExecuteSQL auto-quotes the
+    // PascalCase identifiers.
     const pgTable = '__mj.MagicLinkInvite';
-    const pgSql = buildConsumeInviteSQL(pgTable, 'postgresql');
+    const pgSql = buildConsumeInvitePostgresSQL(pgTable);
 
     it('targets the supplied unquoted schema.table', () => {
       expect(pgSql).toContain(`UPDATE ${pgTable} `);
@@ -246,35 +188,32 @@ describe('magic-link core', () => {
 
     it('binds the invite ID as PG positional param $1, not T-SQL @p0 (injection-safe)', () => {
       expect(pgSql).toContain('ID = $1');
-      expect(pgSql).not.toContain('@p0');
-      expect(pgSql).not.toMatch(/@/); // no T-SQL @-anything survives on PG
+      expect(pgSql).not.toMatch(/@/);
       expect(pgSql).not.toMatch(/ID = '/);
     });
 
     it('uses PG timestamp expressions, not T-SQL SYSUTCDATETIME()', () => {
       expect(pgSql).not.toContain('SYSUTCDATETIME');
-      expect(pgSql).toContain("(now() AT TIME ZONE 'utc')");
       expect(pgSql).toContain("ConsumedAt = COALESCE(ConsumedAt, (now() AT TIME ZONE 'utc'))");
     });
 
-    it('guards atomically on Active + not-exhausted + not-expired (same predicate as SS)', () => {
+    it('guards atomically on Active + not-exhausted + not-expired (same predicate as spConsumeMagicLinkInvite)', () => {
       const where = pgSql.slice(pgSql.indexOf('WHERE'));
       expect(where).toContain("Status = 'Active'");
       expect(where).toContain('UseCount < MaxUses');
       expect(where).toContain("ExpiresAt > (now() AT TIME ZONE 'utc')");
     });
 
-    it('increments UseCount and flips Status on the last use (same semantics as SS)', () => {
+    it('increments UseCount and flips Status on the last use (same semantics as spConsumeMagicLinkInvite)', () => {
       expect(pgSql).toContain('UseCount = UseCount + 1');
       expect(pgSql).toContain("Status = CASE WHEN UseCount + 1 >= MaxUses THEN 'Consumed' ELSE Status END");
     });
 
-    it('rejects a non-whitelisted PG table identifier (defense-in-depth against injection)', () => {
-      // Bracket-quoted (SS) form is not a valid PG identifier here.
-      expect(() => buildConsumeInviteSQL('[__mj].[MagicLinkInvite]', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.MagicLinkInvite; DROP TABLE x;--', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL('__mj.Magic Link', 'postgresql')).toThrow();
-      expect(() => buildConsumeInviteSQL(pgTable, 'postgresql')).not.toThrow();
+    it('rejects a non-whitelisted table identifier (defense-in-depth against injection)', () => {
+      expect(() => buildConsumeInvitePostgresSQL('[__mj].[MagicLinkInvite]')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite; DROP TABLE x;--')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL('__mj.Magic Link')).toThrow();
+      expect(() => buildConsumeInvitePostgresSQL(pgTable)).not.toThrow();
     });
   });
 

package/src/__tests__/magicLinkService.consume.test.ts

@@ -0,0 +1,230 @@
+import { describe, it, expect, vi, beforeEach, afterEach, type Mock } from 'vitest';
+
+// MagicLinkService is the imperative shell — importing it pulls the full
+// data-provider and communication stacks in at module load. Stub those out;
+// @memberjunction/core stays real (Metadata, RunView, LogError).
+vi.mock('@memberjunction/generic-database-provider', () => ({
+  UserCache: { Instance: { Users: [] } },
+}));
+vi.mock('@memberjunction/communication-engine', () => ({
+  CommunicationEngine: { Instance: {} },
+}));
+vi.mock('@memberjunction/communication-types', () => ({
+  Message: class {},
+}));
+vi.mock('../config.js', () => ({
+  configInfo: {},
+}));
+// Provisioning is stubbed in this suite; keep the real provider stack out of the module graph.
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => {
+    throw new Error('provisioning is stubbed in this suite');
+  },
+}));
+
+import { Metadata, RunView, type DatabaseProviderBase, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
+import type { MagicLinkConfig } from '../config.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { MAGIC_LINK_TOKEN_PREFIX, buildConsumeInvitePostgresSQL } from '../auth/magicLink/magicLinkCore.js';
+
+type Platform = 'sqlserver' | 'postgresql';
+
+/** Provider surface consumeInvite/RedeemInvite touch, with real-shaped dialect behavior. */
+interface FakeProvider {
+  PlatformKey: Platform;
+  MJCoreSchemaName: string;
+  Roles: { ID: string; Name: string }[];
+  Applications: { ID: string; Name: string; Path: string }[];
+  Dialect: { ProcedureCallSyntax: (schema: string, name: string, params: string[]) => string };
+  BuildParameterPlaceholder: (index: number) => string;
+  ExecuteSQL: Mock;
+}
+
+function makeProvider(platform: Platform): FakeProvider {
+  const isPg = platform === 'postgresql';
+  return {
+    PlatformKey: platform,
+    MJCoreSchemaName: '__mj',
+    Roles: [{ ID: 'role-1', Name: 'Magic Link Baseline' }],
+    Applications: [],
+    Dialect: {
+      ProcedureCallSyntax: isPg
+        ? (s, n, p) => `SELECT * FROM ${s}."${n}"(${p.join(', ')})`
+        : (s, n, p) => `EXEC [${s}].[${n}] ${p.join(', ')}`,
+    },
+    BuildParameterPlaceholder: isPg ? (i) => `$${i + 1}` : (i) => `@p${i}`,
+    ExecuteSQL: vi.fn(),
+  };
+}
+
+const INVITE_ID = '11111111-2222-3333-4444-555555555555';
+
+function makeInvite(): MJMagicLinkInviteEntity {
+  return {
+    ID: INVITE_ID,
+    Status: 'Active',
+    UseCount: 0,
+    MaxUses: 1,
+    ExpiresAt: new Date(Date.now() + 3600_000),
+    RoleID: 'role-1',
+    CreatedByUserID: 'inviter-1',
+    ApplicationID: 'app-1',
+    Email: 'g@example.com',
+  } as unknown as MJMagicLinkInviteEntity;
+}
+
+/** Private surface of MagicLinkService the tests drive or stub. */
+interface ServicePrivates {
+  consumeInvite: (invite: MJMagicLinkInviteEntity, provider: DatabaseProviderBase, contextUser: UserInfo) => Promise<string>;
+  resolveProvisioningContextUser: () => UserInfo | null;
+  isInviterActive: (id: string) => boolean;
+  recordRedemption: () => Promise<void>;
+  provisionUser: () => Promise<{ success: boolean; error?: string }>;
+}
+
+describe('MagicLinkService.consumeInvite (#4753)', () => {
+  let service: MagicLinkService;
+  let privates: ServicePrivates;
+  let invite: MJMagicLinkInviteEntity;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+
+  beforeEach(() => {
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    privates = service as unknown as ServicePrivates;
+    invite = makeInvite();
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  async function consume(provider: FakeProvider): Promise<string> {
+    return privates.consumeInvite(invite, provider as unknown as DatabaseProviderBase, contextUser);
+  }
+
+  it('SQL Server: calls spConsumeMagicLinkInvite with the ID bound by name, never interpolated', async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe('EXEC [__mj].[spConsumeMagicLinkInvite] @ID=@p0');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+    expect(String(sql).toUpperCase()).not.toContain('UPDATE');
+  });
+
+  // PG has no spConsumeMagicLinkInvite function (the release-time converter does not emit
+  // procedures) and PG's runtime roles hold table DML, so PG keeps the direct guarded UPDATE.
+  it('PostgreSQL: runs the guarded UPDATE … RETURNING directly, with the ID bound as $1', async () => {
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    await consume(provider);
+
+    expect(provider.ExecuteSQL).toHaveBeenCalledTimes(1);
+    const [sql, params, options, user] = provider.ExecuteSQL.mock.calls[0];
+    expect(sql).toBe(buildConsumeInvitePostgresSQL('__mj.MagicLinkInvite'));
+    expect(sql).not.toContain('spConsumeMagicLinkInvite');
+    expect(params).toEqual([INVITE_ID]);
+    expect(options).toEqual(expect.objectContaining({ isMutation: true }));
+    expect(user).toBe(contextUser);
+    expect(sql).not.toContain(INVITE_ID);
+  });
+
+  it("PostgreSQL: maps one row to 'won', zero rows to 'lost', and a thrown error to 'failed'", async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('postgresql');
+    provider.ExecuteSQL.mockResolvedValueOnce([{ ID: INVITE_ID }]).mockResolvedValueOnce([]).mockRejectedValueOnce(new Error('connection reset'));
+
+    expect(await consume(provider)).toBe('won');
+    expect(await consume(provider)).toBe('lost');
+    expect(await consume(provider)).toBe('failed');
+  });
+
+  it("returns 'won' when exactly one row comes back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    expect(await consume(provider)).toBe('won');
+  });
+
+  it("returns 'lost' when zero rows come back", async () => {
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue([]);
+    expect(await consume(provider)).toBe('lost');
+  });
+
+  it("returns 'failed' and logs the invite ID when ExecuteSQL throws", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID) && line.includes('spConsumeMagicLinkInvite'))).toBe(true);
+  });
+
+  it("returns 'failed' when ExecuteSQL returns a non-array", async () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const provider = makeProvider('sqlserver');
+    provider.ExecuteSQL.mockResolvedValue(undefined);
+
+    expect(await consume(provider)).toBe('failed');
+    const logged = errorSpy.mock.calls.map((call) => call.map(String).join(' '));
+    expect(logged.some((line) => line.includes(INVITE_ID))).toBe(true);
+  });
+});
+
+describe('MagicLinkService.RedeemInvite consume outcome mapping (#4753)', () => {
+  let service: MagicLinkService;
+  let provider: FakeProvider;
+  let provisionUser: Mock;
+  const contextUser = { ID: 'ctx-user' } as UserInfo;
+  const rawToken = MAGIC_LINK_TOKEN_PREFIX + 'x';
+
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    provider = makeProvider('sqlserver');
+    Metadata.Provider = provider as unknown as IMetadataProvider;
+
+    service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);
+    const privates = service as unknown as ServicePrivates;
+    vi.spyOn(RunView.prototype, 'RunView').mockResolvedValue({ Success: true, Results: [makeInvite()] } as Awaited<ReturnType<RunView['RunView']>>);
+    vi.spyOn(privates, 'resolveProvisioningContextUser').mockReturnValue(contextUser);
+    vi.spyOn(privates, 'isInviterActive').mockReturnValue(true);
+    vi.spyOn(privates, 'recordRedemption').mockResolvedValue(undefined);
+    provisionUser = vi.fn().mockResolvedValue({ success: false, error: 'stop-here' });
+    privates.provisionUser = provisionUser;
+  });
+
+  afterEach(() => {
+    Metadata.Provider = null as unknown as IMetadataProvider;
+  });
+
+  it('RedeemInvite maps a failed consume to server_error, not consumed, and never provisions', async () => {
+    provider.ExecuteSQL.mockRejectedValue(new Error("The EXECUTE permission was denied on the object 'spConsumeMagicLinkInvite'"));
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'server_error' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite still reports consumed when the race is lost', async () => {
+    provider.ExecuteSQL.mockResolvedValue([]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'consumed' }));
+    expect(provisionUser).not.toHaveBeenCalled();
+  });
+
+  it('RedeemInvite proceeds to provisioning when the consume wins', async () => {
+    provider.ExecuteSQL.mockResolvedValue([{ ID: INVITE_ID }]);
+    const result = await service.RedeemInvite(rawToken);
+
+    expect(provisionUser).toHaveBeenCalledTimes(1);
+    expect(result).toEqual(expect.objectContaining({ success: false, errorCode: 'provisioning_failed' }));
+  });
+});

package/src/__tests__/magicLinkService.provisionLog.test.ts

@@ -16,6 +16,10 @@ vi.mock('@memberjunction/communication-types', () => ({
 vi.mock('../config.js', () => ({
   configInfo: {},
 }));
+const isolated = vi.hoisted(() => ({ provider: null as unknown }));
+vi.mock('../isolatedProvider.js', () => ({
+  CreateIsolatedProvider: async () => isolated.provider,
+}));
 
 import { Metadata, type IMetadataProvider, type RoleInfo, type UserInfo } from '@memberjunction/core';
 import type { MJMagicLinkInviteEntity } from '@memberjunction/core-entities';
@@ -62,6 +66,7 @@ describe('MagicLinkService provisioning log policy', () => {
       RollbackTransaction: async () => undefined,
       GetEntityObject: async (entityName: string) => makeMockEntity(`mock-${entityName}`),
     };
+    isolated.provider = provider;
     Metadata.Provider = provider as unknown as IMetadataProvider;
 
     service = new MagicLinkService('https://mj.example.com', {} as MagicLinkConfig);

package/src/__tests__/multiTenancy.postgresRewrite.test.ts

@@ -0,0 +1,181 @@
+/**
+ * The tenant PreRunView hook checks the caller's ExtraFilter and builds
+ * `(<ExtraFilter>) AND (<tenant predicate>)`. On PostgreSQL the provider then rewrites the whole
+ * filter (identifier quoting, T-SQL date functions, boolean literals), and that rewrite can change
+ * the caller's part after the hook checked it. These tests run the real hook, the real PostgreSQL
+ * rewrite and the real view query builder, with only ExecuteSQL recorded, and pin that the tenant
+ * predicate stays a separate AND term whatever the rewrite does to the caller's term. The last
+ * block runs the same path with no hook and pins that the per-term rewrite keeps a SQL Server
+ * bracket name whole.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+    ClearAllDataHooks,
+    Metadata,
+    RegisterDataHook,
+    UserInfo,
+    type EntityInfo,
+    type IMetadataProvider,
+} from '@memberjunction/core';
+import { PostgreSQLDataProvider } from '@memberjunction/postgresql-dataprovider';
+import type { SQLParserDialect } from '@memberjunction/sql-dialect';
+import { IsBalancedSQLFragment, SplitTopLevelAndTerms } from '@memberjunction/sql-parser';
+import { createTenantPreRunViewHook } from '../multiTenancy/index.js';
+import type { MultiTenancyConfig } from '../config.js';
+
+const TENANT_TERM = `(("OrganizationID" = 't1'))`;
+
+/** The real PostgreSQL provider over one entity fixture, with every executed statement recorded. */
+class RecordingPostgreSQLProvider extends PostgreSQLDataProvider {
+    public readonly ExecutedSQL: string[] = [];
+
+    constructor(private readonly testEntities: EntityInfo[]) {
+        super();
+    }
+
+    public override get Entities(): EntityInfo[] {
+        return this.testEntities;
+    }
+
+    public override async ExecuteSQL<T>(sql: string): Promise<T[]> {
+        this.ExecutedSQL.push(sql);
+        return [];
+    }
+}
+
+/** A tenant-scoped entity with a boolean field, which the PostgreSQL rewrite coerces. */
+function customersEntity(): EntityInfo {
+    const field = (name: string, tsType: string) => ({ Name: name, CodeName: name, TSType: tsType, IsVirtual: false });
+    const fields = [field('ID', 'string'), field('Name', 'string'), field('OrganizationID', 'string'), field('IsActive', 'boolean')];
+    return {
+        ID: 'ENT-CUSTOMERS',
+        Name: 'Customers',
+        SchemaName: 'app',
+        BaseView: 'vwCustomers',
+        Fields: fields,
+        PrimaryKeys: [fields[0]],
+        FirstPrimaryKey: fields[0],
+        FieldByName: (n: string) => fields.find((f) => f.Name.toLowerCase() === n.trim().toLowerCase()),
+        DatetimeFields: [],
+        ExternalDataSourceID: null,
+        UserViewMaxRows: 0,
+        EnableFieldLevelSecurity: false,
+        AuditViewRuns: false,
+        GetUserPermisions: () => ({ CanRead: true }),
+        GetEffectiveRowFilterWhereClause: () => '',
+    } as unknown as EntityInfo;
+}
+
+function tenantConfig(): MultiTenancyConfig {
+    return {
+        enabled: true,
+        contextSource: 'header',
+        tenantHeader: 'x-tenant-id',
+        scopingStrategy: 'allowlist',
+        scopedEntities: ['Customers'],
+        autoExcludeCoreEntities: true,
+        defaultTenantColumn: 'OrganizationID',
+        entityColumnMappings: {},
+        adminRoles: ['Admin'],
+        writeProtection: 'strict',
+    };
+}
+
+/** The WHERE clause of the one statement the provider ran. */
+function whereOf(provider: RecordingPostgreSQLProvider): string {
+    expect(provider.ExecutedSQL).toHaveLength(1);
+    const sql = provider.ExecutedSQL[0];
+    return sql.substring(sql.indexOf(' WHERE ') + ' WHERE '.length);
+}
+
+/**
+ * Whether `term` is one of the top-level AND terms inside the one pair of parentheses around
+ * `where`. Only then does it narrow every row the query returns.
+ */
+function isTopLevelAndTerm(where: string, term: string, dialect: SQLParserDialect): boolean {
+    const inner = where.slice(1, -1);
+    const wrapped = where.startsWith('(') && where.endsWith(')') && IsBalancedSQLFragment(inner, dialect).IsBalanced;
+    return wrapped && (SplitTopLevelAndTerms(inner, dialect) ?? []).some((t) => t.trim() === term);
+}
+
+describe('Multi-tenancy on PostgreSQL — the provider rewrite cannot reach the tenant predicate', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+    let user: UserInfo;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+        RegisterDataHook('PreRunView', createTenantPreRunViewHook(tenantConfig()));
+        user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+        user.TenantContext = { TenantID: 't1', Source: 'header' };
+    });
+
+    afterEach(() => {
+        ClearAllDataHooks();
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps the tenant predicate a separate AND term when the rewrite changes the caller term', async () => {
+        // The rewrite turns the caller's quoted text into boolean literals and changes where its
+        // parentheses close. Each term is rewritten and wrapped on its own, so that change stays
+        // inside the caller's term.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE) AND ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('keeps the tenant predicate its own AND term after a quote the boolean rewrite drops, followed by a top-level OR', async () => {
+        // The rewrite drops the quote, so text the hook read inside a string literal becomes code
+        // with a top-level OR. The tenant predicate must still narrow every row.
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) OR (1=1) OR ("IsActive" = 1'` }, user);
+
+        expect(result.Success).toBe(true);
+        const where = whereOf(provider);
+        expect(isTopLevelAndTerm(where, TENANT_TERM, provider.Dialect), `tenant predicate is not a top-level AND term of ${where}`).toBe(true);
+        expect(where).toBe(`((("IsActive" = TRUE) OR (1=1) OR ("IsActive" = TRUE)) AND ${TENANT_TERM})`);
+    });
+
+    it('refuses a caller term that the rewrite leaves unbalanced, and runs no SQL', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = '1) AND (1 = 1'` }, user);
+
+        expect(provider.ExecutedSQL).toEqual([]);
+        expect(result.Success).toBe(false);
+        expect(result.ErrorMessage).toMatch(/ExtraFilter/);
+    });
+
+    it('leaves an ordinary filter and the tenant predicate as written, each in its own term', async () => {
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: `"IsActive" = 1 OR "Name" = 'a'` }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe(`((("IsActive" = TRUE OR "Name" = 'a')) AND ${TENANT_TERM})`);
+    });
+});
+
+describe('PostgreSQL ExtraFilter rewrite with no PreRunView hook', () => {
+    let provider: RecordingPostgreSQLProvider;
+    let savedProvider: IMetadataProvider;
+
+    beforeEach(() => {
+        provider = new RecordingPostgreSQLProvider([customersEntity()]);
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        ClearAllDataHooks();
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    it('keeps a SQL Server bracket name that contains AND whole when it rewrites each AND term', async () => {
+        const user = new UserInfo(provider, { ID: 'U1', Email: 'u1@example.com' });
+
+        const result = await provider.RunView({ EntityName: 'Customers', ExtraFilter: '[Profit and Loss] > 0 AND [IsActive] = 1' }, user);
+
+        expect(result.Success).toBe(true);
+        expect(whereOf(provider)).toBe('(("Profit and Loss" > 0) AND ("IsActive" = TRUE))');
+    });
+});

package/src/__tests__/multiTenancy.security.test.ts

@@ -518,6 +518,57 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
   });
 
+  // ─── Client ExtraFilter containment ───────────────────────────────────
+
+  describe('client ExtraFilter must stay inside its parentheses', () => {
+    // The hook builds `(<ExtraFilter>) AND (<tenant>)`. A filter that closes a parenthesis it did
+    // not open turns that into `(1=1) OR (1=1) AND (<tenant>)`: AND binds tighter than OR, so the
+    // tenant predicate would narrow only one side of an OR the caller controls.
+    const escapes = [
+      '1=1) OR (1=1',
+      "Name = 'a') OR (Name = 'b'",
+      '1=1)) OR ((1=1',
+    ];
+
+    it.each(escapes)('refuses the ExtraFilter %j instead of ANDing the tenant predicate onto it', (extraFilter) => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: extraFilter } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/parenthesis/);
+    });
+
+    it('refuses an ExtraFilter that ends inside an unterminated string literal', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/unterminated/);
+    });
+
+    it('refuses an ExtraFilter that contains a comment', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a' -- note\n" } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/comment/);
+    });
+
+    it('applies the PostgreSQL rules too when the provider dialect is unknown', () => {
+      // The mocked Metadata.Provider here is not a database provider, so the hook reads the filter
+      // with every supported dialect.
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: 'Name = $$x$$' } as RunViewParams;
+
+      expect(() => hook(params, makeUser('tenant-abc'))).toThrow(/dollar/);
+    });
+
+    it('keeps a balanced ExtraFilter and the tenant predicate as separate parenthesized terms', () => {
+      const hook = createTenantPreRunViewHook(makeConfig());
+      const params = { EntityName: 'Customers', ExtraFilter: "Name = 'a) OR (b' OR Name = 'c'" } as RunViewParams;
+
+      const result = hook(params, makeUser('tenant-abc')) as RunViewParams;
+      expect(result.ExtraFilter).toBe("(Name = 'a) OR (b' OR Name = 'c') AND ([OrganizationID] = 'tenant-abc')");
+    });
+  });
+
   // ─── PreSave security edge cases ──────────────────────────────────────
 
   describe('PreSave security', () => {

package/src/__tests__/multiTenancy.test.ts

@@ -87,7 +87,7 @@ describe('Multi-Tenancy Hooks', () => {
 
       const result = hook(params, user);
       expect((result as RunViewParams).ExtraFilter).toBe(
-        "(Status = 'Active') AND [OrganizationID] = 'tenant-abc'"
+        "(Status = 'Active') AND ([OrganizationID] = 'tenant-abc')"
       );
     });