@memberjunction/server 6.1.5 → 6.1.6

package/src/__tests__/AdhocQueryResolver.sqlAuthorizer.test.ts

@@ -0,0 +1,104 @@
+// type-graphql decorators call `Reflect.getMetadata`, which only exists once this polyfill is
+// loaded. MUST precede any import that pulls in the resolver file.
+import 'reflect-metadata';
+
+/**
+ * MJServer registers an ad-hoc SQL authorizer with the action engine so that Run Ad-hoc Query, which
+ * agents run as the calling user, applies the same checks as the ExecuteAdhocQuery resolver: the
+ * rendered SQL must be one read statement, every table it reads must be an entity base view the
+ * caller may read in full (no row-level filter, no denied field), and the timeout is limited by the
+ * server's request timeout.
+ *
+ * Every SQL statement below is harmless.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+vi.mock('type-graphql', () => {
+  const noopDecorator = () => () => undefined;
+  return {
+    Resolver: noopDecorator, Mutation: noopDecorator, Query: noopDecorator, Subscription: noopDecorator,
+    ObjectType: noopDecorator, InputType: noopDecorator, Field: noopDecorator, Arg: noopDecorator,
+    Args: noopDecorator, Ctx: noopDecorator, PubSub: noopDecorator, Root: noopDecorator,
+    Directive: noopDecorator, Authorized: noopDecorator, UseMiddleware: noopDecorator,
+    createUnionType: () => class {},
+    AuthorizationError: class AuthorizationError extends Error {},
+    Float: class {}, Int: class {}, ID: class {},
+  };
+});
+
+// The server config is read from mj.config at import; the authorizer takes its timeout as an argument.
+vi.mock('../config.js', () => ({ configInfo: { databaseSettings: { requestTimeout: 120_000 } } }));
+
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import { CreateAdhocSQLAuthorizer } from '../resolvers/AdhocQueryResolver.js';
+import { ClampAdhocTimeoutSeconds } from '../resolvers/adhocTimeout.js';
+
+type EntityShape = { Name: string; SchemaName: string; BaseView: string; rowFilter?: string };
+
+/** A read-only provider with the entity metadata the table check reads. */
+function readOnlyProvider(entities: EntityShape[]): DatabaseProviderBase {
+  return {
+    PlatformKey: 'sqlserver',
+    Entities: entities.map((e) => ({
+      Name: e.Name,
+      SchemaName: e.SchemaName,
+      BaseView: e.BaseView,
+      GetUserPermisions: () => ({ CanRead: true }),
+      GetEffectiveRowFilterWhereClause: () => e.rowFilter ?? '',
+      GetDeniedReadFields: () => new Set<string>(),
+    })),
+  } as unknown as DatabaseProviderBase;
+}
+
+const USER = { ID: 'user-1', Email: 'user@example.com' } as unknown as UserInfo;
+const RUBRIC_EVALUATIONS: EntityShape = { Name: 'MJ: Rubric Evaluations', SchemaName: '__mj', BaseView: 'vwRubricEvaluations' };
+const REQUEST_TIMEOUT_MS = 120_000;
+
+describe('CreateAdhocSQLAuthorizer', () => {
+  const authorizer = CreateAdhocSQLAuthorizer(REQUEST_TIMEOUT_MS);
+
+  it('admits SQL that reads only entity views the user may read in full', () => {
+    const refusal = authorizer.Authorize('SELECT ID FROM [__mj].[vwRubricEvaluations]', readOnlyProvider([RUBRIC_EVALUATIONS]), USER);
+
+    expect(refusal).toBeNull();
+  });
+
+  it('refuses SQL that reads an entity the user may read only through a row filter', () => {
+    const filtered = { ...RUBRIC_EVALUATIONS, rowFilter: "EvaluatorUserID='user-1'" };
+
+    const refusal = authorizer.Authorize('SELECT * FROM __mj.vwRubricEvaluations', readOnlyProvider([filtered]), USER);
+
+    expect(refusal).toMatch(/row-level-security filtered/);
+  });
+
+  it('refuses SQL that reads a table that is not an entity view', () => {
+    const refusal = authorizer.Authorize('SELECT * FROM [__mj].[User]', readOnlyProvider([RUBRIC_EVALUATIONS]), USER);
+
+    expect(refusal).toMatch(/entity base view/);
+  });
+
+  it('refuses a stacked batch hidden behind a bracket identifier', () => {
+    const refusal = authorizer.Authorize("SELECT 1 AS [a'] ; SELECT 2 AS [b']", readOnlyProvider([RUBRIC_EVALUATIONS]), USER);
+
+    expect(refusal).toMatch(/single read query/);
+  });
+
+  it('limits the timeout the way ExecuteAdhocQuery does', () => {
+    for (const requested of [undefined, 5, 600]) {
+      expect(authorizer.ClampTimeoutSeconds(requested)).toBe(ClampAdhocTimeoutSeconds(requested, REQUEST_TIMEOUT_MS));
+    }
+    expect(authorizer.ClampTimeoutSeconds(600)).toBe(120);
+  });
+});
+
+describe('MJServer startup', () => {
+  // Startup needs a database, so this one assertion reads the source.
+  it('registers the read-only provider factory and this authorizer with the action engine', () => {
+    const src = readFileSync(resolve(__dirname, '../index.ts'), 'utf8');
+
+    expect(/ActionEngineServer\.Instance\.SetReadOnlyProviderFactory\(\s*\(\)\s*=>\s*CreateReadOnlyProvider\(dataSources\)\s*\)/.test(src)).toBe(true);
+    expect(/ActionEngineServer\.Instance\.SetAdhocSQLAuthorizer\(\s*CreateAdhocSQLAuthorizer\(configInfo\.databaseSettings\.requestTimeout\)\s*\)/.test(src)).toBe(true);
+  });
+});

package/src/__tests__/DatasetResolver.itemFilters.test.ts

@@ -0,0 +1,201 @@
+// The resolvers carry type-graphql decorators, which need the Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, vi } from 'vitest';
+import {
+    DatabaseProviderBase,
+    DatasetItemFilterType,
+    DatasetResultType,
+    DatasetStatusResultType,
+    EntityInfo,
+    UserInfo,
+} from '@memberjunction/core';
+import { ENCRYPTED_SENTINEL } from '@memberjunction/global';
+import { DatasetResolverExtended, DatasetStatusResolver } from '../resolvers/DatasetResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+// The encrypted-field policy configures the encryption engine before it inspects a value; there is
+// no key store in a unit test.
+vi.mock('@memberjunction/encryption', () => ({
+    EncryptionEngine: {
+        Instance: {
+            Config: async () => undefined,
+            GetKeyByID: () => ({ Marker: '$ENC$' }),
+            Encrypt: async (value: string) => `$ENC$${value}`,
+        },
+    },
+}));
+
+/**
+ * The GraphQL dataset queries are the network edge of security finding C6.
+ *
+ * `GetDatasetByName` / `GetDatasetStatusByName` took `ItemFilters[].Filter` from any authenticated
+ * principal and handed it to the provider unscreened, and passed no context user, so the provider
+ * could neither refuse an unreadable item nor apply row-level security. These tests pin that the
+ * resolvers screen every ItemFilter with the same AST screen as ExtraFilter before the provider is
+ * reached, pass the session user down, and apply the API encryption policy to the rows they return.
+ */
+
+const ROLE_ID = 'R0000000-0000-0000-0000-00000000000A';
+const OTHER_ROLE_ID = 'R0000000-0000-0000-0000-00000000000C';
+
+function entity(name: string, baseView: string, fields: Record<string, unknown>[] = []): EntityInfo {
+    const id = `E-${name}`;
+    return new EntityInfo({
+        ID: id, Name: name, SchemaName: '__mj', BaseTable: name, BaseView: baseView,
+        Permissions: [{ ID: `p-${name}`, EntityID: id, RoleID: ROLE_ID, CanRead: true, Type: 'Allow' }],
+        Fields: fields.map((f, i) => ({ ID: `${id}-f${i}`, EntityID: id, Entity: name, Sequence: i + 1, Type: 'nvarchar', ...f })),
+    });
+}
+
+const THINGS = entity('Things', 'vwThings', [{ Name: 'ID', IsPrimaryKey: true }, { Name: 'Name' }]);
+const SECRETS = entity('Secrets', 'vwSecrets', [
+    { Name: 'ID', IsPrimaryKey: true },
+    { Name: 'Token', Encrypt: true, EncryptionKeyID: 'K1', AllowDecryptInAPI: false, SendEncryptedValue: false },
+]);
+
+const USER = new UserInfo(undefined, {
+    ID: 'U1', Name: 'Reader', Email: 'reader@example.com', IsActive: true,
+    UserRoles: [{ UserID: 'U1', RoleID: ROLE_ID, Role: 'Reader' }],
+});
+
+type ProviderCall = {
+    Method: 'GetDatasetByName' | 'GetDatasetStatusByName';
+    DatasetName: string;
+    ItemFilters: DatasetItemFilterType[] | undefined;
+    ContextUser: UserInfo | undefined;
+};
+
+/** A provider double that records what reached it and answers with fixed rows. */
+function fakeProvider(itemEntity: EntityInfo = THINGS, rows: Record<string, unknown>[] = []) {
+    const calls: ProviderCall[] = [];
+    const provider = {
+        Entities: [THINGS, SECRETS],
+        EntityByName: (name: string) => [THINGS, SECRETS].find(e => e.Name.toLowerCase() === name?.trim().toLowerCase()),
+        GetDatasetByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetResultType> => {
+            calls.push({ Method: 'GetDatasetByName', DatasetName, ItemFilters, ContextUser });
+            return {
+                DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0),
+                Results: [{ Code: itemEntity.Name, EntityName: itemEntity.Name, EntityID: itemEntity.ID, Results: rows, Success: true }],
+            };
+        },
+        GetDatasetStatusByName: async (DatasetName: string, ItemFilters?: DatasetItemFilterType[], ContextUser?: UserInfo): Promise<DatasetStatusResultType> => {
+            calls.push({ Method: 'GetDatasetStatusByName', DatasetName, ItemFilters, ContextUser });
+            return { DatasetID: 'DS1', DatasetName, Success: true, Status: '', LatestUpdateDate: new Date(0), EntityUpdateDates: [] };
+        },
+    };
+    return { provider: provider as unknown as DatabaseProviderBase, calls };
+}
+
+function context(provider: DatabaseProviderBase, userPayload: Partial<UserPayload> = { email: USER.Email, userRecord: USER }): AppContext {
+    return {
+        providers: [{ provider, type: 'Read-Write' }],
+        userPayload: { sessionId: 'S1', ...userPayload } as UserPayload,
+    } as AppContext;
+}
+
+const STACKED = [{ ItemCode: 'Things', Filter: '1=0; SELECT 1' }];
+// A quote inside a bracket identifier opens a fake literal for the string-literal stripper that
+// guards the provider denylist; the AST screen tokenizes brackets and still sees the second statement.
+const STACKED_BEHIND_BRACKET = [{ ItemCode: 'Things', Filter: "[a'] = 1; SELECT 1 --'" }];
+
+describe('GetDatasetByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses a stacked statement hidden behind a bracket identifier', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), STACKED_BEHIND_BRACKET))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('refuses an ItemFilter whose subquery reads a table that is not an entity base view', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.[User])' }];
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('MJ_Metadata', context(provider), filters))
+            .rejects.toThrow(/entity base view/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider, with the screened filters', async () => {
+        const { provider, calls } = fakeProvider();
+        const filters = [{ ItemCode: 'Things', Filter: "Name = 'x'" }];
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider), filters);
+
+        expect(result.Success).toBe(true);
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+        expect(calls[0].ItemFilters).toEqual(filters);
+    });
+
+    it('refuses a session that resolves to no user rather than reading as nobody', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetResolverExtended().GetDatasetByName('Things_Dataset', context(provider, { email: '', userRecord: null })))
+            .rejects.toThrow(/no user/i);
+        expect(calls).toEqual([]);
+    });
+
+    it('masks an encrypted field the entity does not allow decrypted over the API, without touching the provider rows', async () => {
+        // A context user makes the provider decrypt; the API policy decides what leaves the server.
+        const providerRow = Object.freeze({ ID: 'S1', Token: 'plain-secret' });
+        const { provider } = fakeProvider(SECRETS, [providerRow]);
+
+        const result = await new DatasetResolverExtended().GetDatasetByName('Secrets_Dataset', context(provider));
+
+        const items = JSON.parse(result.Results) as DatasetResultType['Results'];
+        expect(items[0].Results[0].Token).toBe(ENCRYPTED_SENTINEL);
+        expect(result.Results).not.toContain('plain-secret');
+        expect(providerRow.Token).toBe('plain-secret');
+    });
+});
+
+describe('GetDatasetStatusByName', () => {
+    it('refuses a stacked-statement ItemFilter before the provider is reached', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('MJ_Metadata', context(provider), STACKED))
+            .rejects.toThrow(/multiple statements are not permitted/);
+        expect(calls).toEqual([]);
+    });
+
+    it('passes the session user to the provider', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider), [{ ItemCode: 'Things', Filter: "Name = 'x'" }]);
+
+        expect(calls).toHaveLength(1);
+        expect(calls[0].ContextUser).toBe(USER);
+    });
+
+    it('refuses an ItemFilter that reads an entity the user has no read permission on', async () => {
+        const { provider, calls } = fakeProvider();
+        const outsider = new UserInfo(undefined, {
+            ID: 'U2', Name: 'Outsider', Email: 'outsider@example.com', IsActive: true,
+            UserRoles: [{ UserID: 'U2', RoleID: OTHER_ROLE_ID, Role: 'Other' }],
+        });
+        const filters = [{ ItemCode: 'Things', Filter: 'ID IN (SELECT ID FROM __mj.vwSecrets)' }];
+
+        await expect(new DatasetStatusResolver().GetDatasetStatusByName('Things_Dataset', context(provider, { email: outsider.Email, userRecord: outsider }), filters))
+            .rejects.toThrow(/read permission/);
+        expect(calls).toEqual([]);
+    });
+});
+
+describe('GetMultipleDatasetStatusByName', () => {
+    it('passes the session user to the provider for every dataset', async () => {
+        const { provider, calls } = fakeProvider();
+
+        await new DatasetStatusResolver().GetMultipleDatasetStatusByName(['A', 'B'], context(provider));
+
+        expect(calls.map(c => c.ContextUser)).toEqual([USER, USER]);
+    });
+});

package/src/__tests__/EntityRecordNameResolver.fieldSecurity.test.ts

@@ -7,43 +7,22 @@ import type { DatabaseProviderBase, EntityInfo, UserInfo } from '@memberjunction
 import { EntityRecordNameResolver } from '../resolvers/EntityRecordNameResolver.js';
 
 /**
- * `GetEntityRecordName` must not hand back a name the caller cannot READ.
- *
- * This resolver predates field-level security and took no user context at all, which made it an
- * open side channel: the name never travelled through `MapFieldNamesToCodeNames`, the boundary
- * that strips denied fields, so a caller denied READ on an entity's name field could still obtain
- * that name from here.
- *
- * FLS turned the latent gap into a live bypass, and the shape of it is worth remembering: the
- * form-field FK control falls through to this query PRECISELY WHEN the joined display column is
- * denied. The fallback that exists to handle a denial was the thing that defeated it. Found in
- * manual Phase 5 testing — a Contract form showed its Client's name while the grid, correctly,
- * did not.
+ * `GetEntityRecordName` hands the acting user to the provider, which applies field- and row-level
+ * security for them, and reports a withheld name exactly as it reports a missing record. The
+ * field-level rule itself is covered by MJCore's DatabaseProviderBase record-name tests.
  */
 
-const DENIED_USER = { ID: 'u-1', Email: 'restricted@test' } as unknown as UserInfo;
+const ACTING_USER = { ID: 'u-1', Email: 'restricted@test' } as unknown as UserInfo;
 
-/** An entity whose name field is denied or allowed, per the flag. */
-function entityInfo(opts: { fls: boolean; deniedNames?: string[]; nameField?: string }): EntityInfo {
-    const nameFieldName = opts.nameField ?? 'Name';
-    return {
-        Name: 'Clients',
-        EnableFieldLevelSecurity: opts.fls,
-        Fields: [
-            { Name: 'ID', IsNameField: false },
-            { Name: nameFieldName, IsNameField: true },
-            { Name: 'Industry', IsNameField: false },
-        ],
-        GetDeniedReadFields: () => new Set(opts.deniedNames ?? []),
-    } as unknown as EntityInfo;
-}
+const ENTITY = { Name: 'Clients' } as unknown as EntityInfo;
 
-/** A provider that would happily return the name — the resolver must decide not to ask. */
-function providerWith(entity: EntityInfo, getName = vi.fn().mockResolvedValue('Acme Manufacturing')) {
+/** A provider whose lookup answers with `name` ('' when it withholds or finds nothing). */
+function providerAnswering(name: string) {
+    const getName = vi.fn().mockResolvedValue(name);
     return {
-        Entities: [entity],
-        GetEntityRecordName: getName,
-    } as unknown as DatabaseProviderBase & { GetEntityRecordName: typeof getName };
+        md: { Entities: [ENTITY], GetEntityRecordName: getName } as unknown as DatabaseProviderBase,
+        getName,
+    };
 }
 
 /** Exposes the inner method so the test does not need a GraphQL context. */
@@ -57,62 +36,38 @@ class Probe extends EntityRecordNameResolver {
 
 const KEY = new CompositeKey([{ FieldName: 'ID', Value: 'c-1' }]);
 
-describe('GetEntityRecordName — field-security gate', () => {
-    it('withholds the name when the name field is read-denied', async () => {
-        const getName = vi.fn().mockResolvedValue('Acme Manufacturing');
-        const md = providerWith(entityInfo({ fls: true, deniedNames: ['name'] }), getName);
+describe('GetEntityRecordName — security is applied for the acting user', () => {
+    it('passes the acting user to the provider lookup', async () => {
+        const { md, getName } = providerAnswering('Acme Manufacturing');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
-        expect(result.Success).toBe(false);
-        expect(result.RecordName).toBeUndefined();
-        // Not merely filtered after the fact — the lookup must not run at all. The provider's
-        // record-name cache is keyed by entity + primary key and NOT by user, so a name fetched
-        // here would be visible to any later caller.
-        expect(getName).not.toHaveBeenCalled();
+        expect(getName).toHaveBeenCalledWith('Clients', expect.anything(), ACTING_USER);
     });
 
-    it('returns the name when the user may read the name field', async () => {
-        const md = providerWith(entityInfo({ fls: true, deniedNames: ['industry'] }));
+    it('returns the name the provider allows', async () => {
+        const { md } = providerAnswering('Acme Manufacturing');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
         expect(result.Success).toBe(true);
         expect(result.RecordName).toBe('Acme Manufacturing');
     });
 
-    it('is inert when the entity has field security switched off', async () => {
-        // Nearly every entity. A denial set that would otherwise match must not apply.
-        const md = providerWith(entityInfo({ fls: false, deniedNames: ['name'] }));
+    it('reports a withheld name as unsuccessful, with no name', async () => {
+        const { md } = providerAnswering('');
 
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
-
-        expect(result.Success).toBe(true);
-        expect(result.RecordName).toBe('Acme Manufacturing');
-    });
-
-    it('honours a designated name field that is not literally called "Name"', async () => {
-        const md = providerWith(entityInfo({ fls: true, nameField: 'Title', deniedNames: ['title'] }));
-
-        const result = await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
         expect(result.Success).toBe(false);
+        expect(result.RecordName).toBeUndefined();
     });
 
-    it('passes the acting user to the provider so row-level security has an identity', async () => {
-        const getName = vi.fn().mockResolvedValue('Acme Manufacturing');
-        const md = providerWith(entityInfo({ fls: true }), getName);
-
-        await new Probe().Inner(md, 'Clients', KEY, DENIED_USER);
+    it('does not disclose which of "missing" or "restricted" applies', async () => {
+        const { md } = providerAnswering('');
 
-        expect(getName).toHaveBeenCalledWith('Clients', expect.anything(), DENIED_USER);
-    });
+        const result = await new Probe().Inner(md, 'Clients', KEY, ACTING_USER);
 
-    it('does not disclose which of "missing" or "restricted" applies', async () => {
-        // The denial status must read the same as a genuine not-found, so the query cannot be
-        // used to probe for which entities carry restricted name fields.
-        const denied = await new Probe().Inner(
-            providerWith(entityInfo({ fls: true, deniedNames: ['name'] })), 'Clients', KEY, DENIED_USER);
-        expect(denied.Status).not.toMatch(/denied|permission|restricted|field.security/i);
+        expect(result.Status).not.toMatch(/denied|permission|restricted|field.security|RLS/i);
     });
 });

package/src/__tests__/EntityRecordNameResolver.rowSecurity.test.ts

@@ -0,0 +1,152 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { CompositeKey, DatabaseProviderBase, EntityInfo, EntityPermissionType, Metadata, RowLevelSecurityFilterInfo, UserInfo } from '@memberjunction/core';
+import type { DeleteSQLResult, IMetadataProvider, QueryExecutionSpec, RunQueryResult, SaveSQLResult } from '@memberjunction/core';
+import { EntityRecordNameResolver } from '../resolvers/EntityRecordNameResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * The record-name queries against a real provider whose database only records what it is sent.
+ * The lookup the resolver causes carries the acting user's read row filter, binds the key value,
+ * refuses a key that is not the entity's primary key, and never runs without an acting user.
+ */
+
+const CLIENTS_ID = 'E0000000-0000-0000-0000-0000000000C1';
+const ACCOUNT_MANAGER_ROLE_ID = 'B0000000-0000-0000-0000-0000000000C1';
+const OWN_CLIENTS_FILTER_ID = 'F0000000-0000-0000-0000-0000000000C1';
+const MANAGER_ID = 'C0000000-0000-0000-0000-0000000000C1';
+const CLIENT_ID_VALUE = '33333333-3333-3333-3333-333333333333';
+
+const ROW_FILTERS: RowLevelSecurityFilterInfo[] = [
+    new RowLevelSecurityFilterInfo({ ID: OWN_CLIENTS_FILTER_ID, Name: 'Own clients', FilterText: "AccountManagerID = '{{UserID}}'" }),
+];
+
+/** `Clients`: account managers read only the clients they manage. */
+function clientsEntity(): EntityInfo {
+    return new EntityInfo({
+        ID: CLIENTS_ID, Name: 'Clients', SchemaName: 'dbo', BaseTable: 'Client', BaseView: 'vwClients',
+        Permissions: [
+            { ID: 'perm-manager', EntityID: CLIENTS_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, CanRead: true, ReadRLSFilterID: OWN_CLIENTS_FILTER_ID, Type: 'Allow' },
+        ],
+        Fields: [
+            { ID: 'cl-id', EntityID: CLIENTS_ID, Sequence: 1, Name: 'ID', Type: 'uniqueidentifier', IsPrimaryKey: true, NeedsQuotes: true },
+            { ID: 'cl-name', EntityID: CLIENTS_ID, Sequence: 2, Name: 'Name', Type: 'nvarchar', IsNameField: true, NeedsQuotes: true },
+            { ID: 'cl-tier', EntityID: CLIENTS_ID, Sequence: 3, Name: 'Tier', Type: 'int', NeedsQuotes: false },
+            { ID: 'cl-manager', EntityID: CLIENTS_ID, Sequence: 4, Name: 'AccountManagerID', Type: 'uniqueidentifier', NeedsQuotes: true },
+        ],
+    });
+}
+
+interface SentQuery {
+    SQL: string;
+    Parameters: unknown[] | undefined;
+}
+
+/** A SQL Server-shaped provider over `Clients`, whose database answers every query with one row. */
+class RecordingProvider extends DatabaseProviderBase {
+    public Sent: SentQuery[] = [];
+    private readonly entities = [clientsEntity()];
+
+    public override get Entities(): EntityInfo[] {
+        return this.entities;
+    }
+
+    public override get RowLevelSecurityFilters(): RowLevelSecurityFilterInfo[] {
+        return ROW_FILTERS;
+    }
+
+    async ExecuteSQL<T>(sql: string, parameters?: unknown[]): Promise<Array<T>> {
+        this.Sent.push({ SQL: sql, Parameters: parameters });
+        return [{ Name: 'Acme Manufacturing' }] as T[];
+    }
+
+    public override BuildParameterPlaceholder(index: number): string { return `@p${index}`; }
+    protected get UUIDFunctionPattern(): RegExp { return /^newid\(\)$/i; }
+    protected get DBDefaultFunctionPattern(): RegExp { return /^getdate\(\)$/i; }
+    public QuoteIdentifier(name: string): string { return `[${name}]`; }
+    public QuoteSchemaAndView(schema: string, obj: string): string { return `[${schema}].[${obj}]`; }
+    protected BuildChildDiscoverySQL(): string { return ''; }
+    protected BuildHardLinkDependencySQL(): string { return ''; }
+    protected BuildSoftLinkDependencySQL(): string { return ''; }
+    protected async GenerateSaveSQL(): Promise<SaveSQLResult> { return { fullSQL: '' }; }
+    protected GenerateDeleteSQL(): DeleteSQLResult { return { fullSQL: '' }; }
+    protected BuildRecordChangeSQL(): { sql: string; parameters?: unknown[] } | null { return null; }
+    protected BuildSiblingRecordChangeSQL(): string { return ''; }
+    async BeginTransaction(): Promise<void> {}
+    async CommitTransaction(): Promise<void> {}
+    async RollbackTransaction(): Promise<void> {}
+    protected async InternalExecuteQueryFromSpec(_spec: QueryExecutionSpec): Promise<RunQueryResult> {
+        throw new Error('Not supported.');
+    }
+}
+
+const MANAGER = new UserInfo(null, {
+    ID: MANAGER_ID, Name: 'Morgan', Email: 'morgan@example.com', IsActive: true,
+    UserRoles: [{ UserID: MANAGER_ID, RoleID: ACCOUNT_MANAGER_ROLE_ID, Role: 'Account Managers' }],
+});
+
+function key(fieldName: string, value: string): CompositeKey {
+    return new CompositeKey([{ FieldName: fieldName, Value: value }]);
+}
+
+describe('EntityRecordNameResolver lookups under row-level security', () => {
+    let provider: RecordingProvider;
+    let savedProvider: IMetadataProvider;
+    let context: AppContext;
+    const resolver = new EntityRecordNameResolver();
+
+    beforeEach(() => {
+        provider = new RecordingProvider();
+        // Row filters resolve through the global provider.
+        savedProvider = Metadata.Provider;
+        Metadata.Provider = provider;
+        const userPayload: UserPayload = { email: MANAGER.Email, userRecord: MANAGER, sessionId: 'session-1' };
+        context = { dataSource: undefined, dataSources: [], providers: [{ provider, type: 'Read-Only' }], userPayload };
+    });
+
+    afterEach(() => {
+        Metadata.Provider = savedProvider;
+    });
+
+    function managerRowFilter(): string {
+        return provider.EntityByName('Clients').GetEffectiveRowFilterWhereClause(MANAGER, EntityPermissionType.Read, '');
+    }
+
+    it("looks the name up under the acting user's read row filter, with the key value bound", async () => {
+        const rowFilter = managerRowFilter();
+        expect(rowFilter).toContain(MANAGER_ID);
+
+        const result = await resolver.GetEntityRecordName('Clients', key('ID', CLIENT_ID_VALUE), context);
+
+        expect(result.Success).toBe(true);
+        expect(provider.Sent).toEqual([
+            { SQL: `SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`, Parameters: [CLIENT_ID_VALUE] },
+        ]);
+    });
+
+    it('applies the row filter to each item of a batch', async () => {
+        const rowFilter = managerRowFilter();
+
+        const results = await resolver.GetEntityRecordNames([{ EntityName: 'Clients', CompositeKey: key('ID', CLIENT_ID_VALUE) }], context);
+
+        expect(results.map(r => r.Success)).toEqual([true]);
+        expect(provider.Sent.map(q => q.SQL)).toEqual([`SELECT [Name] FROM [dbo].[vwClients] WHERE [ID]=@p0 AND (${rowFilter})`]);
+    });
+
+    it('refuses a key field that is not a primary key, without querying', async () => {
+        const result = await resolver.GetEntityRecordName('Clients', key('Tier', '1'), context);
+
+        expect(result.Success).toBe(false);
+        expect(result.RecordName).toBeUndefined();
+        expect(provider.Sent).toHaveLength(0);
+    });
+
+    it('looks no name up when there is no acting user', async () => {
+        const result = await resolver.InnerGetEntityRecordName(provider, 'Clients', key('ID', CLIENT_ID_VALUE));
+
+        expect(result.Success).toBe(false);
+        expect(provider.Sent).toHaveLength(0);
+    });
+});