@memberjunction/server 6.1.4 → 6.2.0-edge.1

package/src/__tests__/multiTenancy.security.test.ts

@@ -7,11 +7,11 @@
  */
 import { describe, it, expect, vi } from 'vitest';
 import {
-  createTenantPreRunViewHook,
-  createTenantPreSaveHook,
-  createTenantMiddleware,
+  CreateTenantPreRunViewHook,
+  CreateTenantPreSaveHook,
+  CreateTenantMiddleware,
   IsValidTenantId,
-  attachTenantContext,
+  AttachTenantContext,
 } from '../multiTenancy/index.js';
 import type { MultiTenancyConfig } from '../config.js';
 import { Metadata } from '@memberjunction/core';
@@ -76,7 +76,7 @@ function makeConfig(overrides: Partial<MultiTenancyConfig> = {}): MultiTenancyCo
   };
 }
 
-type MockUser = Parameters<ReturnType<typeof createTenantPreRunViewHook>>[1];
+type MockUser = Parameters<ReturnType<typeof CreateTenantPreRunViewHook>>[1];
 
 function makeUser(tenantId?: string, roles: string[] = []): MockUser {
   return {
@@ -91,7 +91,7 @@ function makeUser(tenantId?: string, roles: string[] = []): MockUser {
 describe('Multi-Tenancy Security Edge Cases', () => {
   describe('SQL injection in tenant ID', () => {
     it('should escape quotes so an injection attempt stays INSIDE the string literal', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' OR 1=1 --");
 
@@ -105,7 +105,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should escape quotes in a UNION attack payload', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("' UNION SELECT * FROM Users --");
 
@@ -115,7 +115,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should escape quotes in a stacked-statement payload', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("abc'; DROP TABLE Customers; --");
 
@@ -177,19 +177,19 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
     it('throws on an invalid tenant id instead of attaching it', () => {
       const user = makePlainUser();
-      expect(() => attachTenantContext(user, "x' OR '1'='1", 'header')).toThrow(/Invalid tenant identifier/);
+      expect(() => AttachTenantContext(user, "x' OR '1'='1", 'header')).toThrow(/Invalid tenant identifier/);
       expect(user.TenantContext).toBeUndefined();
     });
 
     it('throws on empty and oversized tenant ids', () => {
       const user = makePlainUser();
-      expect(() => attachTenantContext(user, '', 'custom')).toThrow(/Invalid tenant identifier/);
-      expect(() => attachTenantContext(user, 'a'.repeat(129), 'custom')).toThrow(/Invalid tenant identifier/);
+      expect(() => AttachTenantContext(user, '', 'custom')).toThrow(/Invalid tenant identifier/);
+      expect(() => AttachTenantContext(user, 'a'.repeat(129), 'custom')).toThrow(/Invalid tenant identifier/);
     });
 
     it('attaches a valid tenant id with the given source', () => {
       const user = makePlainUser();
-      attachTenantContext(user, 'tenant_1.a-b', 'linkedEntity');
+      AttachTenantContext(user, 'tenant_1.a-b', 'linkedEntity');
       expect(user.TenantContext).toEqual<TenantContext>({ TenantID: 'tenant_1.a-b', Source: 'linkedEntity' });
     });
   });
@@ -198,7 +198,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
   describe('tenant column must resolve to a stored field', () => {
     it('produces an escaped-value predicate with a quoted identifier for a valid setup', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser("t'1"); // legal only via non-header sources; must still be escaped
 
@@ -207,7 +207,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('throws when the configured tenant column does not exist on the entity', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'NoSuchColumn' }));
+      const hook = CreateTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'NoSuchColumn' }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-1');
 
@@ -215,7 +215,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('throws when the tenant column resolves only to a VIRTUAL field', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'OrganizationName' }));
+      const hook = CreateTenantPreRunViewHook(makeConfig({ defaultTenantColumn: 'OrganizationName' }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-1');
 
@@ -223,7 +223,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('throws when an entityColumnMappings override points at a nonexistent column', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         entityColumnMappings: { 'Customers': "Bad]Column" },
       }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
@@ -237,7 +237,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
       // @ts-expect-error — simulating the no-provider-available case
       Metadata.Provider = undefined;
       try {
-        const hook = createTenantPreRunViewHook(makeConfig());
+        const hook = CreateTenantPreRunViewHook(makeConfig());
         const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
         const user = makeUser('tenant-1');
 
@@ -255,7 +255,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
   describe('Tenant ID boundary values', () => {
     it('should not filter when tenant ID is empty string (falsy)', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       // Empty string is falsy → makeUser sets TenantContext = undefined
       // This matches createTenantMiddleware behavior: `if (tenantId)` skips empty strings
@@ -267,7 +267,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
     it('should handle very long tenant ID', () => {
       const longId = 'a'.repeat(1000);
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser(longId);
 
@@ -277,7 +277,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
     it('should handle UUID tenant ID (standard format)', () => {
       const uuid = '550e8400-e29b-41d4-a716-446655440000';
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser(uuid);
 
@@ -286,7 +286,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle tenant ID with special characters', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant<script>alert(1)</script>');
 
@@ -299,7 +299,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
   describe('Admin role matching', () => {
     it('should be case-insensitive for admin role matching', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({ adminRoles: ['Admin'] }));
+      const hook = CreateTenantPreRunViewHook(makeConfig({ adminRoles: ['Admin'] }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
 
       // User role is 'admin' (lowercase), config has 'Admin'
@@ -309,7 +309,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle whitespace in role names', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({ adminRoles: [' Admin '] }));
+      const hook = CreateTenantPreRunViewHook(makeConfig({ adminRoles: [' Admin '] }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
 
       const user = makeUser('tenant-1', ['Admin']);
@@ -318,7 +318,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should not bypass for non-admin roles', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({ adminRoles: ['Admin'] }));
+      const hook = CreateTenantPreRunViewHook(makeConfig({ adminRoles: ['Admin'] }));
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
 
       const user = makeUser('tenant-1', ['User', 'Editor']);
@@ -327,7 +327,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle user with empty roles array', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
 
       const user = makeUser('tenant-1', []);
@@ -340,7 +340,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
   describe('Entity name matching', () => {
     it('should be case-insensitive for entity names in allowlist', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         scopingStrategy: 'allowlist',
         scopedEntities: ['customers'],
       }));
@@ -352,7 +352,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle whitespace in entity names', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         scopingStrategy: 'allowlist',
         scopedEntities: [' Customers '],
       }));
@@ -364,7 +364,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should not filter when EntityName is missing from params', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-1');
 
@@ -377,7 +377,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
 
   describe('createTenantMiddleware', () => {
     it('should skip tenant resolution when no userPayload on request', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const req = { headers: { 'x-tenant-id': 'tenant-1' } } as unknown as Parameters<typeof middleware>[0];
       const res = {} as Parameters<typeof middleware>[1];
       const next = vi.fn();
@@ -388,7 +388,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should attach TenantContext to a CLONED userRecord when userPayload and header are present', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
       const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
@@ -414,7 +414,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should reject an invalid tenant header with 400 and never attach or continue', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
       const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
@@ -437,7 +437,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle case-insensitive header name', () => {
-      const middleware = createTenantMiddleware(makeConfig({ tenantHeader: 'X-Tenant-ID' }));
+      const middleware = CreateTenantMiddleware(makeConfig({ tenantHeader: 'X-Tenant-ID' }));
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
       const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
@@ -457,7 +457,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should not set TenantContext when header is missing', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
       const req = {
         headers: {},
@@ -472,7 +472,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should reject a repeated header (array value) with 400 rather than guessing which value applies', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const userRecord = { ID: 'u1' } as Record<string, unknown>;
       const userPayload = { userRecord, email: 'test@test.com', sessionId: 's1' };
       const req = {
@@ -494,7 +494,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('two concurrent requests for the same shared user with different headers do not cross-contaminate', () => {
-      const middleware = createTenantMiddleware(makeConfig());
+      const middleware = CreateTenantMiddleware(makeConfig());
       const sharedUserRecord = { ID: 'u1', UserRoles: [] } as unknown as Record<string, unknown>;
 
       const reqA = {
@@ -527,11 +527,11 @@ describe('Multi-Tenancy Security Edge Cases', () => {
         IsSaved: isSaved,
         Get: vi.fn((col: string) => col === 'OrganizationID' ? tenantValue : null),
         Set: vi.fn(),
-      } as unknown as Parameters<ReturnType<typeof createTenantPreSaveHook>>[0];
+      } as unknown as Parameters<ReturnType<typeof CreateTenantPreSaveHook>>[0];
     }
 
     it('should reject save with SQL injection in entity tenant column', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', "' OR 1=1 --", true);
       const user = makeUser('tenant-abc');
 
@@ -541,13 +541,13 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should auto-assign tenant for new record even when entity has no EntityInfo', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = {
         EntityInfo: undefined,
         IsSaved: false,
         Get: vi.fn(() => null),
         Set: vi.fn(),
-      } as unknown as Parameters<ReturnType<typeof createTenantPreSaveHook>>[0];
+      } as unknown as Parameters<ReturnType<typeof CreateTenantPreSaveHook>>[0];
       const user = makeUser('tenant-abc');
 
       // No EntityInfo → no entity name → not scoped → allow
@@ -556,7 +556,7 @@ describe('Multi-Tenancy Security Edge Cases', () => {
     });
 
     it('should handle null contextUser gracefully', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', 'tenant-abc', true);
 
       const result = hook(entity, undefined);

package/src/__tests__/multiTenancy.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { createTenantPreRunViewHook, createTenantPreSaveHook } from '../multiTenancy/index.js';
+import { CreateTenantPreRunViewHook, CreateTenantPreSaveHook } from '../multiTenancy/index.js';
 import type { MultiTenancyConfig } from '../config.js';
 import type { RunViewParams } from '@memberjunction/core';
 
@@ -66,13 +66,13 @@ function makeUser(tenantId?: string, roles: string[] = []) {
     ID: 'user-1',
     TenantContext: tenantId ? { TenantID: tenantId, Source: 'header' as const } : undefined,
     UserRoles: roles.map(r => ({ Role: r, RoleID: `role-${r}`, UserID: 'user-1' })),
-  } as Parameters<ReturnType<typeof createTenantPreRunViewHook>>[1];
+  } as Parameters<ReturnType<typeof CreateTenantPreRunViewHook>>[1];
 }
 
 describe('Multi-Tenancy Hooks', () => {
   describe('createTenantPreRunViewHook', () => {
     it('should inject tenant filter for scoped entity', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-abc');
 
@@ -81,7 +81,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should AND with existing filter', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: "Status = 'Active'" } as RunViewParams;
       const user = makeUser('tenant-abc');
 
@@ -92,7 +92,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should skip core __mj entities when autoExcludeCoreEntities is true', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'AI Models', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-abc');
 
@@ -101,7 +101,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should not filter when user has no TenantContext', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser(undefined);
 
@@ -110,7 +110,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should bypass filtering for admin users', () => {
-      const hook = createTenantPreRunViewHook(makeConfig());
+      const hook = CreateTenantPreRunViewHook(makeConfig());
       const params = { EntityName: 'Customers', ExtraFilter: '' } as RunViewParams;
       const user = makeUser('tenant-abc', ['Admin']);
 
@@ -119,7 +119,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should use entity column mapping override', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         entityColumnMappings: { 'Orders': 'TenantID' },
       }));
       const params = { EntityName: 'Orders', ExtraFilter: '' } as RunViewParams;
@@ -130,7 +130,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should respect allowlist scoping strategy', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         scopingStrategy: 'allowlist',
         scopedEntities: ['Customers'],
       }));
@@ -148,7 +148,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should respect denylist scoping strategy', () => {
-      const hook = createTenantPreRunViewHook(makeConfig({
+      const hook = CreateTenantPreRunViewHook(makeConfig({
         scopingStrategy: 'denylist',
         scopedEntities: ['Orders'],
       }));
@@ -173,11 +173,11 @@ describe('Multi-Tenancy Hooks', () => {
         IsSaved: isSaved,
         Get: vi.fn((col: string) => col === 'OrganizationID' ? tenantValue : null),
         Set: vi.fn(),
-      } as unknown as Parameters<ReturnType<typeof createTenantPreSaveHook>>[0];
+      } as unknown as Parameters<ReturnType<typeof CreateTenantPreSaveHook>>[0];
     }
 
     it('should allow save when tenant matches', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', 'tenant-abc', true);
       const user = makeUser('tenant-abc');
 
@@ -186,7 +186,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should reject save in strict mode when tenant mismatches', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', 'tenant-other', true);
       const user = makeUser('tenant-abc');
 
@@ -197,7 +197,7 @@ describe('Multi-Tenancy Hooks', () => {
 
     it('should warn but allow in log mode when tenant mismatches', () => {
       const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-      const hook = createTenantPreSaveHook(makeConfig({ writeProtection: 'log' }));
+      const hook = CreateTenantPreSaveHook(makeConfig({ writeProtection: 'log' }));
       const entity = makeEntity('Customers', 'tenant-other', true);
       const user = makeUser('tenant-abc');
 
@@ -208,7 +208,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should allow when writeProtection is off', () => {
-      const hook = createTenantPreSaveHook(makeConfig({ writeProtection: 'off' }));
+      const hook = CreateTenantPreSaveHook(makeConfig({ writeProtection: 'off' }));
       const entity = makeEntity('Customers', 'tenant-other', true);
       const user = makeUser('tenant-abc');
 
@@ -217,7 +217,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should auto-assign tenant for new records without tenant value', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', null, false);
       const user = makeUser('tenant-abc');
 
@@ -227,7 +227,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should bypass validation for admin users', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('Customers', 'tenant-other', true);
       const user = makeUser('tenant-abc', ['Admin']);
 
@@ -236,7 +236,7 @@ describe('Multi-Tenancy Hooks', () => {
     });
 
     it('should skip core __mj entities', () => {
-      const hook = createTenantPreSaveHook(makeConfig());
+      const hook = CreateTenantPreSaveHook(makeConfig());
       const entity = makeEntity('AI Models', 'any-tenant', true);
       const user = makeUser('tenant-abc');
 

package/src/__tests__/newUsers.test.ts

@@ -168,7 +168,8 @@ vi.mock('@memberjunction/global', async (importOriginal) => {
     };
 });
 
-vi.mock('../auth/initializeProviders.js', () => ({ initializeAuthProviders: vi.fn() }));
+vi.mock('../auth/initializeProviders.js', () => ({ InitializeAuthProviders: vi.fn(),
+    get initializeAuthProviders() { return this.InitializeAuthProviders; } }));
 
 vi.mock('@memberjunction/auth-providers', () => ({
     AuthProviderFactory: {
@@ -195,7 +196,7 @@ vi.mock('@memberjunction/api-keys', () => ({
 
 // ─── Import after mocks ─────────────────────────────────────────────────────
 import { NewUserBase } from '../auth/newUsers.js';
-import { verifyUserRecord } from '../auth/index.js';
+import { VerifyUserRecord } from '../auth/index.js';
 
 // ─── Mock-entity plumbing ───────────────────────────────────────────────────
 
@@ -557,7 +558,7 @@ describe('verifyUserRecord', () => {
     }
 
     it('returns undefined when no email is supplied', async () => {
-        const user = await verifyUserRecord(undefined, 'A', 'B');
+        const user = await VerifyUserRecord(undefined, 'A', 'B');
 
         expect(user).toBeUndefined();
         expect(mockGetEntityObject).not.toHaveBeenCalled();
@@ -566,7 +567,7 @@ describe('verifyUserRecord', () => {
     it('returns the cached user, matching email case-insensitively and trimmed', async () => {
         addCacheUser('someone@example.com');
 
-        const user = await verifyUserRecord('  SomeOne@Example.COM  ', 'A', 'B');
+        const user = await VerifyUserRecord('  SomeOne@Example.COM  ', 'A', 'B');
 
         expect(user).toBeDefined();
         expect((user as unknown as { Email: string }).Email).toBe('someone@example.com');
@@ -577,7 +578,7 @@ describe('verifyUserRecord', () => {
         mockCacheUsers.push({ ID: 'broken-1', Name: 'Broken', Email: '  ', Type: 'User' });
         const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
 
-        const user = await verifyUserRecord('missing@example.com', undefined, undefined);
+        const user = await VerifyUserRecord('missing@example.com', undefined, undefined);
 
         expect(user).toBeUndefined();
         expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('broken-1'));
@@ -587,15 +588,15 @@ describe('verifyUserRecord', () => {
         it('does NOT create a user when autoCreateNewUsers is false', async () => {
             mockConfig.userHandling.autoCreateNewUsers = false;
 
-            const user = await verifyUserRecord('new@example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
         });
 
         it('does NOT create a user when firstName or lastName is missing', async () => {
-            const missingFirst = await verifyUserRecord('new@example.com', undefined, 'User');
-            const missingLast = await verifyUserRecord('new@example.com', 'New', undefined);
+            const missingFirst = await VerifyUserRecord('new@example.com', undefined, 'User');
+            const missingLast = await VerifyUserRecord('new@example.com', 'New', undefined);
 
             expect(missingFirst).toBeUndefined();
             expect(missingLast).toBeUndefined();
@@ -605,7 +606,7 @@ describe('verifyUserRecord', () => {
         it('creates the user when enabled and domains are unrestricted, stamping config roles onto the returned UserInfo', async () => {
             mockConfig.userHandling.newUserRoles = ['UI', 'Developer'];
 
-            const user = await verifyUserRecord('new@example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeDefined();
             const stamped = user as unknown as { Email: string; UserRoles: Array<{ Role: string; RoleID: string; UserID: string }> };
@@ -621,7 +622,7 @@ describe('verifyUserRecord', () => {
         it('returns undefined when the underlying createNewUser fails', async () => {
             saveBehavior['MJ: Users'] = () => false;
 
-            const user = await verifyUserRecord('new@example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             // The cache is no longer empty at rest (it holds the configured context user), so
@@ -637,35 +638,35 @@ describe('verifyUserRecord', () => {
         });
 
         it('creates the user when the email domain is authorized', async () => {
-            const user = await verifyUserRecord('new@example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeDefined();
             expect(entitiesOf('MJ: Users')).toHaveLength(1);
         });
 
         it('does NOT create when the email domain is not authorized', async () => {
-            const user = await verifyUserRecord('new@evil.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@evil.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
         });
 
         it('creates when restricted and no request Origin is supplied, if the email domain is authorized', async () => {
-            const user = await verifyUserRecord('new@example.com', 'New', 'User', undefined);
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User', undefined);
 
             expect(user).toBeDefined();
             expect(entitiesOf('MJ: Users')).toHaveLength(1);
         });
 
         it('does NOT create when a forged Origin is authorized but the email domain is not', async () => {
-            const user = await verifyUserRecord('new@evil.com', 'New', 'User', 'example.com');
+            const user = await VerifyUserRecord('new@evil.com', 'New', 'User', 'example.com');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
         });
 
         it('matches email domains case-insensitively', async () => {
-            const user = await verifyUserRecord('new@EXAMPLE.COM', 'New', 'User');
+            const user = await VerifyUserRecord('new@EXAMPLE.COM', 'New', 'User');
 
             expect(user).toBeDefined();
         });
@@ -673,7 +674,7 @@ describe('verifyUserRecord', () => {
         it('supports wildcard patterns for email subdomains', async () => {
             mockConfig.userHandling.newUserAuthorizedDomains = ['*.example.com'];
 
-            const user = await verifyUserRecord('new@mail.example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@mail.example.com', 'New', 'User');
 
             expect(user).toBeDefined();
         });
@@ -681,7 +682,7 @@ describe('verifyUserRecord', () => {
         it('does NOT match the apex against "*.example.com" (pattern is matched in full)', async () => {
             mockConfig.userHandling.newUserAuthorizedDomains = ['*.example.com'];
 
-            const user = await verifyUserRecord('new@example.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
@@ -690,27 +691,27 @@ describe('verifyUserRecord', () => {
         it('rejects prefix confusion: "*.example.com" does not match "evilexample.com" (dot is escaped)', async () => {
             mockConfig.userHandling.newUserAuthorizedDomains = ['*.example.com'];
 
-            const user = await verifyUserRecord('new@evilexample.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@evilexample.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
         });
 
         it('rejects suffix confusion: the pattern is anchored, so "example.com.evil.com" is not authorized', async () => {
-            const user = await verifyUserRecord('new@example.com.evil.com', 'New', 'User');
+            const user = await VerifyUserRecord('new@example.com.evil.com', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
         });
 
         it('rejects "evilexample.com" against the plain "example.com" pattern (anchored at both ends)', async () => {
-            const user = await verifyUserRecord('x@evilexample.com', 'New', 'User');
+            const user = await VerifyUserRecord('x@evilexample.com', 'New', 'User');
 
             expect(user).toBeUndefined();
         });
 
         it('does NOT create when the identity has no email domain (username-only IdP)', async () => {
-            const user = await verifyUserRecord('bare-username', 'New', 'User');
+            const user = await VerifyUserRecord('bare-username', 'New', 'User');
 
             expect(user).toBeUndefined();
             expect(mockGetEntityObject).not.toHaveBeenCalled();
@@ -727,7 +728,7 @@ describe('verifyUserRecord', () => {
             });
             const dataSource = {} as unknown as import('mssql').ConnectionPool;
 
-            const user = await verifyUserRecord('late@example.com', undefined, undefined, undefined, dataSource);
+            const user = await VerifyUserRecord('late@example.com', undefined, undefined, undefined, dataSource);
 
             expect(user).toBeDefined();
             expect((user as unknown as { Email: string }).Email).toBe('late@example.com');
@@ -739,7 +740,7 @@ describe('verifyUserRecord', () => {
             mockConfig.userHandling.updateCacheWhenNotFound = true;
             const dataSource = {} as unknown as import('mssql').ConnectionPool;
 
-            const user = await verifyUserRecord('never@example.com', undefined, undefined, undefined, dataSource);
+            const user = await VerifyUserRecord('never@example.com', undefined, undefined, undefined, dataSource);
 
             expect(user).toBeUndefined();
             expect(mockRefresh).toHaveBeenCalledTimes(1);