@memberjunction/server 6.1.5 → 6.1.6

package/src/__tests__/ResolverBase.adhocReadScope.test.ts

@@ -0,0 +1,227 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabasePlatform, IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { RenderPipeline } from '@memberjunction/generic-database-provider';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+/**
+ * The ad-hoc SQL screen (`assertFullQueryUsesReadableEntityViews`) admits a table reference
+ * only when it resolves to an entity base view the caller can read UNSCOPED. These tests pin
+ * the three ways that resolution was looser than it looked (PR #4782 review):
+ *
+ * - a schema-qualified reference fell back to a bare-name match in another schema;
+ * - an unqualified name present in two schemas resolved to whichever loaded last;
+ * - entity CanRead was treated as unscoped read authority, though raw SQL applies neither the
+ *   row-level filter nor the denied-field projection RunView does.
+ */
+
+type EntityShape = {
+    Name: string;
+    SchemaName: string;
+    BaseView: string;
+    canRead?: boolean;
+    rowFilter?: string;
+    deniedFields?: string[];
+};
+
+function fakeProvider(entities: EntityShape[], platform?: DatabasePlatform): IMetadataProvider {
+    return {
+        PlatformKey: platform,
+        Entities: entities.map((e) => ({
+            Name: e.Name,
+            SchemaName: e.SchemaName,
+            BaseView: e.BaseView,
+            GetUserPermisions: () => ({ CanRead: e.canRead ?? true }),
+            GetEffectiveRowFilterWhereClause: () => e.rowFilter ?? '',
+            GetDeniedReadFields: () => new Set(e.deniedFields ?? []),
+        })),
+    } as unknown as IMetadataProvider;
+}
+
+const USER = { ID: 'U1', Email: 'u@example.com' } as unknown as UserInfo;
+
+class Probe extends ResolverBase {
+    public Screen(sql: string, provider: IMetadataProvider, user: UserInfo | undefined = USER) {
+        return this.assertFullQueryUsesReadableEntityViews(sql, provider, user, 'ad-hoc SQL');
+    }
+
+    /** Renders the SQL the way `ExecuteAdhocQuery` does, then screens the rendered text. */
+    public ScreenRendered(sql: string, platform: DatabasePlatform, provider: IMetadataProvider) {
+        const rendered = RenderPipeline.Run(sql, { Platform: platform, ContextUser: USER, RequireReadStatement: true });
+        return this.Screen(rendered.Trace.AfterTemplates, provider);
+    }
+}
+
+const PUBLIC_FOO: EntityShape = { Name: 'Public Foo', SchemaName: 'public', BaseView: 'vwFoo' };
+
+describe('assertFullQueryUsesReadableEntityViews', () => {
+    it('admits an unscoped readable base view', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM [public].[vwFoo]', fakeProvider([PUBLIC_FOO]))).not.toThrow();
+    });
+
+    it('does not resolve a schema-qualified reference through another schema', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM secret.vwFoo', fakeProvider([PUBLIC_FOO]))).toThrow(
+            /entity base view, not 'secret.vwFoo'/,
+        );
+    });
+
+    it('refuses an unqualified view name that exists in more than one schema', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Other Foo', SchemaName: 'other', BaseView: 'vwFoo' }]);
+        expect(() => new Probe().Screen('SELECT ID FROM vwFoo', provider)).toThrow(/more than one schema/);
+        expect(() => new Probe().Screen('SELECT ID FROM other.vwFoo', provider)).not.toThrow();
+    });
+
+    it('refuses an entity the caller cannot read', () => {
+        expect(() => new Probe().Screen('SELECT ID FROM public.vwFoo', fakeProvider([{ ...PUBLIC_FOO, canRead: false }]))).toThrow(
+            /read permission/,
+        );
+    });
+
+    it('refuses an entity that is row-level-security filtered for the caller', () => {
+        const provider = fakeProvider([{ ...PUBLIC_FOO, rowFilter: "(UserID = 'U1')" }]);
+        expect(() => new Probe().Screen('SELECT ID, UserID FROM public.vwFoo', provider)).toThrow(/row-level-security/);
+    });
+
+    it('refuses an entity with a field the caller is denied', () => {
+        const provider = fakeProvider([{ ...PUBLIC_FOO, deniedFields: ['secret'] }]);
+        expect(() => new Probe().Screen('SELECT ID FROM public.vwFoo', provider)).toThrow(/not permitted to read/);
+    });
+
+    it('applies the scope check to every reference, including joins and subqueries', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Bar', SchemaName: 'public', BaseView: 'vwBar', rowFilter: '(1=0)' }]);
+        expect(() =>
+            new Probe().Screen('SELECT f.ID FROM public.vwFoo f WHERE f.ID IN (SELECT FooID FROM public.vwBar)', provider),
+        ).toThrow(/'Bar' is row-level-security filtered/);
+    });
+
+    it('applies the scope check to a CASE subquery in the select list', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Bar', SchemaName: 'public', BaseView: 'vwBar', rowFilter: '(1=0)' }]);
+        expect(() =>
+            new Probe().Screen('SELECT CASE WHEN (SELECT COUNT(*) FROM public.vwBar) > 0 THEN 1 ELSE 0 END AS x FROM public.vwFoo', provider),
+        ).toThrow(/'Bar' is row-level-security filtered/);
+    });
+
+    it('applies the scope check to every FROM item when an alias repeats', () => {
+        const provider = fakeProvider([PUBLIC_FOO, { Name: 'Bar', SchemaName: 'public', BaseView: 'vwBar', rowFilter: '(1=0)' }]);
+        expect(() =>
+            new Probe().Screen('SELECT a.ID FROM public.vwBar a WHERE a.ID IN (SELECT a.ID FROM public.vwFoo a)', provider),
+        ).toThrow(/'Bar' is row-level-security filtered/);
+    });
+
+    it('exempts CTE names the statement defines', () => {
+        expect(() =>
+            new Probe().Screen('WITH x AS (SELECT ID FROM public.vwFoo) SELECT ID FROM x', fakeProvider([PUBLIC_FOO])),
+        ).not.toThrow();
+    });
+});
+
+describe('assertFullQueryUsesReadableEntityViews — CTE names', () => {
+    // The parser renames bracket identifiers it cannot read and maps the new names back. The CTE
+    // exemption must only cover names the statement declares, so a name of the renamed form,
+    // quoted or bare, is refused. Orders is row-filtered for the caller; Accounts is not.
+    const ACCOUNTS: EntityShape = { Name: 'Accounts', SchemaName: 'dbo', BaseView: 'vwAccounts' };
+    const ORDERS: EntityShape = { Name: 'Orders', SchemaName: 'dbo', BaseView: 'vwOrders', rowFilter: "(OwnerID = 'U1')" };
+    const DIALECTS: Array<{ Name: string; Platform: DatabasePlatform; Quote: (name: string) => string }> = [
+        { Name: 'SQL Server', Platform: 'sqlserver', Quote: (name) => `[${name}]` },
+        { Name: 'PostgreSQL', Platform: 'postgresql', Quote: (name) => `"${name}"` },
+    ];
+
+    for (const { Name, Platform, Quote } of DIALECTS) {
+        const provider = fakeProvider([ACCOUNTS, ORDERS], Platform);
+
+        it(`refuses a CTE name reserved for the SQL parser, before reading any view (${Name})`, () => {
+            const sql = `WITH ${Quote('a b')} AS (SELECT 1 AS x), _mjid_1 AS (SELECT 1 AS y) SELECT * FROM ${Quote('vwOrders')}`;
+
+            expect(() => new Probe().ScreenRendered(sql, Platform, provider)).toThrow(/reserved for the SQL parser/);
+        });
+
+        it(`refuses a reserved name in any case or quoting (${Name})`, () => {
+            for (const name of ['_MJID_1', Quote('_mjid_1'), '_mjid2_0']) {
+                const sql = `WITH ${Quote('a b')} AS (SELECT 1 AS x), ${name} AS (SELECT 1 AS y) SELECT * FROM ${Quote('vwAccounts')}`;
+                expect(() => new Probe().ScreenRendered(sql, Platform, provider)).toThrow(/reserved for the SQL parser/);
+            }
+        });
+
+        it(`still exempts an ordinary quoted CTE name and screens its body (${Name})`, () => {
+            const cte = Quote('Recent Accounts');
+            const reads = (view: string) => `WITH ${cte} AS (SELECT ID FROM ${Quote(view)}) SELECT ID FROM ${cte}`;
+
+            expect(() => new Probe().ScreenRendered(reads('vwAccounts'), Platform, provider)).not.toThrow();
+            expect(() => new Probe().ScreenRendered(reads('vwOrders'), Platform, provider)).toThrow(/'Orders' is row-level-security filtered/);
+        });
+
+        it(`still refuses a row-filtered view read next to an ordinary quoted CTE (${Name})`, () => {
+            const sql = `WITH ${Quote('a b')} AS (SELECT 1 AS x) SELECT * FROM ${Quote('vwOrders')}`;
+
+            expect(() => new Probe().ScreenRendered(sql, Platform, provider)).toThrow(/'Orders' is row-level-security filtered/);
+        });
+    }
+});
+
+describe('assertFullQueryUsesReadableEntityViews — the CTE exemption covers only a CTE in scope', () => {
+    // Orders is row-filtered for the caller; Accounts is not. Each refused statement reads the real
+    // Orders view at a point where no CTE of that name is in scope, so the read must be checked.
+    const ACCOUNTS: EntityShape = { Name: 'Accounts', SchemaName: 'dbo', BaseView: 'vwAccounts' };
+    const ORDERS: EntityShape = { Name: 'Orders', SchemaName: 'dbo', BaseView: 'vwOrders', rowFilter: "(OwnerID = 'U1')" };
+    const ROW_FILTERED = /'Orders' is row-level-security filtered/;
+    const providers: Record<DatabasePlatform, IMetadataProvider> = {
+        sqlserver: fakeProvider([ACCOUNTS, ORDERS], 'sqlserver'),
+        postgresql: fakeProvider([ACCOUNTS, ORDERS], 'postgresql'),
+    };
+    const screen = (sql: string, platform: DatabasePlatform) => () => new Probe().ScreenRendered(sql, platform, providers[platform]);
+
+    it('refuses a schema-qualified read of a view a CTE is named after (SQL Server dbo, PostgreSQL)', () => {
+        expect(screen('WITH vwOrders AS (SELECT 1 AS y) SELECT * FROM dbo.vwOrders', 'sqlserver')).toThrow(ROW_FILTERED);
+        expect(screen('WITH "vwOrders" AS (SELECT 1 AS y) SELECT * FROM dbo."vwOrders"', 'postgresql')).toThrow(ROW_FILTERED);
+    });
+
+    it('refuses a read outside the subquery or branch whose WITH declares the name (PostgreSQL)', () => {
+        const statements = [
+            'SELECT o.* FROM (WITH "vwOrders" AS (SELECT 1 AS a) SELECT * FROM "vwOrders") s CROSS JOIN "vwOrders" o',
+            'SELECT "ID" FROM "vwAccounts" WHERE EXISTS (WITH "vwOrders" AS (SELECT 1 AS a) SELECT 1 FROM "vwOrders") AND "ID" IN (SELECT "ID" FROM "vwOrders")',
+            'WITH a AS (WITH "vwOrders" AS (SELECT 1 AS x) SELECT * FROM "vwOrders") SELECT * FROM a, "vwOrders"',
+            'SELECT * FROM ((WITH "vwOrders" AS (SELECT 1 AS "ID") SELECT "ID" FROM "vwOrders") UNION SELECT "ID" FROM "vwOrders") u',
+        ];
+        for (const sql of statements) {
+            expect(screen(sql, 'postgresql')).toThrow(ROW_FILTERED);
+        }
+    });
+
+    it('refuses a read in a CTE body that does not see that CTE yet (PostgreSQL without RECURSIVE, SQL Server)', () => {
+        expect(screen('WITH "vwOrders" AS (SELECT * FROM "vwOrders") SELECT * FROM "vwOrders"', 'postgresql')).toThrow(ROW_FILTERED);
+        expect(screen('WITH a AS (SELECT * FROM "vwOrders"), "vwOrders" AS (SELECT 1 AS y) SELECT * FROM a', 'postgresql')).toThrow(ROW_FILTERED);
+        expect(screen('WITH a AS (SELECT * FROM vwOrders), vwOrders AS (SELECT 1 AS y) SELECT * FROM a', 'sqlserver')).toThrow(ROW_FILTERED);
+    });
+
+    it('refuses a quoted read whose name differs from the CTE name once PostgreSQL case rules apply', () => {
+        expect(screen('WITH vworders AS (SELECT 1 AS y) SELECT * FROM "vwOrders"', 'postgresql')).toThrow(ROW_FILTERED);
+        expect(screen('WITH "VWORDERS" AS (SELECT 1 AS y) SELECT * FROM "vwOrders"', 'postgresql')).toThrow(ROW_FILTERED);
+    });
+
+    it('still exempts ordinary CTE references (SQL Server)', () => {
+        const statements = [
+            'WITH Recent AS (SELECT ID FROM vwAccounts) SELECT ID FROM recent',
+            'WITH r AS (SELECT ID FROM vwAccounts UNION ALL SELECT ID FROM r WHERE 1 = 0) SELECT ID FROM r',
+            'WITH a AS (SELECT ID FROM vwAccounts), b AS (SELECT ID FROM a) SELECT ID FROM b WHERE ID IN (SELECT ID FROM a UNION SELECT ID FROM a)',
+        ];
+        for (const sql of statements) {
+            expect(screen(sql, 'sqlserver')).not.toThrow();
+        }
+    });
+
+    it('still exempts ordinary CTE references (PostgreSQL)', () => {
+        const statements = [
+            'WITH recent AS (SELECT "ID" FROM "vwAccounts") SELECT "ID" FROM Recent',
+            'WITH "Recent" AS (SELECT "ID" FROM "vwAccounts") SELECT "ID" FROM "Recent"',
+            'WITH RECURSIVE r AS (SELECT 1 AS n UNION ALL SELECT n + 1 FROM r WHERE n < 3) SELECT n FROM r',
+            'WITH RECURSIVE a AS (SELECT * FROM b), b AS (SELECT "ID" FROM "vwAccounts") SELECT * FROM a',
+            'SELECT * FROM (WITH x AS (SELECT "ID" FROM "vwAccounts") SELECT * FROM x) s',
+            'WITH a AS (SELECT "ID" FROM "vwAccounts") SELECT "ID" FROM (SELECT "ID" FROM a) s WHERE "ID" IN (SELECT "ID" FROM a UNION SELECT "ID" FROM a)',
+        ];
+        for (const sql of statements) {
+            expect(screen(sql, 'postgresql')).not.toThrow();
+        }
+    });
+});

package/src/__tests__/ResolverBase.aggregateScreen.test.ts

@@ -0,0 +1,174 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { AggregateExpression, DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { RunViewResolver, type RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { AppContext, UserPayload } from '../types.js';
+
+/**
+ * `Aggregates[].expression` is spliced into `SELECT <expression> AS [Agg_0] FROM <view> WHERE …`.
+ * The GraphQL-boundary screen must treat it like the other client SQL fragments (ExtraFilter,
+ * OrderBy, OverrideExcludeFilter): one statement, no writes, and subqueries only against entity
+ * base views the caller can read.
+ *
+ * The payloads below are harmless (`SELECT 1`).
+ */
+
+const ENTITY_NAME = 'MJ: Users';
+
+/** An aggregate that carries a second statement. */
+const STACKED_AGGREGATE = "COUNT(*) AS [a'] ; SELECT 1 AS [b'], COUNT(*)";
+
+/** A subquery against a base table rather than an entity base view. */
+const BASE_TABLE_AGGREGATE = 'COUNT(*) + (SELECT COUNT(*) FROM __mj.[User])';
+
+type Captured = { params: RunViewParams | null };
+
+/** Entity metadata the screen reads, plus a `RunView` that records what reached it. */
+function fakeProvider(captured: Captured): DatabaseProviderBase {
+    return {
+        Entities: [
+            {
+                ID: 'E1',
+                Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwUsers',
+                BaseTable: 'User',
+                Fields: [
+                    { Name: 'ID', NeedsQuotes: true },
+                    { Name: 'Name', NeedsQuotes: true },
+                    { Name: 'Sequence', NeedsQuotes: false },
+                ],
+                PrimaryKeys: [{ Name: 'ID' }],
+                GetUserPermisions: () => ({ CanRead: true }),
+            },
+        ],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? { ID: 'E1', Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] } : undefined),
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult;
+        },
+        RunViews: async (params: RunViewParams[]): Promise<RunViewResult[]> => {
+            captured.params = params[0] ?? null;
+            return params.map(() => ({ Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult));
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the boundary screen and the dynamic-view entry point. */
+class Probe extends ResolverBase {
+    public ScreenAll(
+        clauses: { extraFilter?: string | null; aggregates?: AggregateExpression[] | null },
+        provider: DatabaseProviderBase,
+    ) {
+        return this.screenClientViewClauses(clauses, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('ResolverBase.screenClientViewClauses — aggregate expressions', () => {
+    it('rejects an aggregate that carries a second statement', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: STACKED_AGGREGATE }] }, fakeProvider({ params: null })),
+        ).toThrow(/Invalid Aggregate: multiple statements/);
+    });
+
+    it('rejects an aggregate whose subquery reads a base table', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: BASE_TABLE_AGGREGATE }] }, fakeProvider({ params: null })),
+        ).toThrow(/Invalid Aggregate: subquery must use an entity base view/);
+    });
+
+    it('screens every aggregate in the list, not only the first', () => {
+        expect(() =>
+            new Probe().ScreenAll(
+                { aggregates: [{ expression: 'COUNT(*)' }, { expression: STACKED_AGGREGATE }] },
+                fakeProvider({ params: null }),
+            ),
+        ).toThrow(/Invalid Aggregate: multiple statements/);
+    });
+
+    it('leaves an aggregate the parser cannot read to the provider, which refuses it per aggregate', () => {
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: [{ expression: 'COUNT_BIG(*)' }] }, fakeProvider({ params: null })),
+        ).not.toThrow();
+    });
+
+    it('lets ordinary aggregate expressions through', () => {
+        const ordinary = [
+            'COUNT(*)',
+            'SUM(Sequence)',
+            'AVG(Sequence * 2)',
+            'COUNT(DISTINCT Name)',
+            "COUNT(CASE WHEN Name = 'x' THEN 1 END)",
+            'MIN([Name])',
+        ];
+        expect(() =>
+            new Probe().ScreenAll({ aggregates: ordinary.map((expression) => ({ expression })) }, fakeProvider({ params: null })),
+        ).not.toThrow();
+    });
+});
+
+describe('ResolverBase RunView entry points — aggregate expressions', () => {
+    it('RunDynamicViewGeneric never reaches RunView with a stacked aggregate', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, Aggregates: [{ expression: STACKED_AGGREGATE }] } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(/Invalid Aggregate: multiple statements/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes ordinary aggregates through to RunView', async () => {
+        const captured: Captured = { params: null };
+        const aggregates = [{ expression: 'COUNT(*)', alias: 'Total' }, { expression: 'SUM(Sequence)' }];
+        const input = { EntityName: ENTITY_NAME, Aggregates: aggregates } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.Aggregates).toEqual(aggregates);
+    });
+
+    it('RunViews returns a failure result, and never reaches the provider, for a stacked aggregate', async () => {
+        const captured: Captured = { params: null };
+        const provider = fakeProvider(captured);
+        const input = [{ EntityName: ENTITY_NAME, Aggregates: [{ expression: STACKED_AGGREGATE }] }] as Parameters<RunViewResolver['RunViews']>[0];
+
+        const results = await new RunViewResolver().RunViews(
+            input,
+            { providers: [{ type: 'Read-Only', provider }] as unknown as AppContext['providers'], userPayload: fakePayload() } as AppContext,
+            undefined as unknown as PubSubEngine,
+        );
+
+        expect(results).toHaveLength(1);
+        expect(results[0].Success).toBe(false);
+        expect(results[0].ErrorMessage).toMatch(/Invalid Aggregate: multiple statements/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunViews does not fail the batch because one aggregate cannot be parsed', async () => {
+        const captured: Captured = { params: null };
+        const provider = fakeProvider(captured);
+        const input = [
+            { EntityName: ENTITY_NAME, Aggregates: [{ expression: 'COUNT_BIG(*)' }] },
+            { EntityName: ENTITY_NAME },
+        ] as Parameters<RunViewResolver['RunViews']>[0];
+
+        const results = await new RunViewResolver().RunViews(
+            input,
+            { providers: [{ type: 'Read-Only', provider }] as unknown as AppContext['providers'], userPayload: fakePayload() } as AppContext,
+            undefined as unknown as PubSubEngine,
+        );
+
+        expect(results.map((r) => r.Success)).toEqual([true, true]);
+        expect(captured.params?.Aggregates).toEqual([{ expression: 'COUNT_BIG(*)' }]);
+    });
+});

package/src/__tests__/ResolverBase.balancedClause.test.ts

@@ -0,0 +1,155 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, IMetadataProvider, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { PubSubEngine } from 'type-graphql';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { RunDynamicViewInput } from '../generic/RunViewResolver.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * The provider splices a client ExtraFilter as `(<ExtraFilter>) AND (<row-level security>)` and the
+ * tenant hook as `(<ExtraFilter>) AND (<tenant>)`. A fragment that closes a parenthesis it did not
+ * open, such as `1=1) OR (1=1`, turns that into `(1=1) OR (1=1) AND (<rls>)`. AND binds tighter than
+ * OR, so the server filter then narrows only one side of an OR the caller controls.
+ *
+ * The boundary screen parsed each fragment inside the parentheses it adds itself, which hides exactly
+ * that imbalance. These tests pin that the screen requires every fragment to be balanced on its own.
+ */
+
+const ENTITY_NAME = 'MJ: Conversations';
+
+/** Captures what the resolver asked `RunView` for. */
+type Captured = { params: RunViewParams | null };
+
+function fakeProvider(captured: Captured): DatabaseProviderBase {
+    return {
+        Entities: [
+            {
+                ID: 'E1',
+                Name: ENTITY_NAME,
+                SchemaName: '__mj',
+                BaseView: 'vwConversations',
+                BaseTable: 'Conversation',
+                Fields: [{ Name: 'Name', NeedsQuotes: true }],
+                GetUserPermisions: () => ({ CanRead: true }),
+            },
+        ],
+        RunView: async (params: RunViewParams): Promise<RunViewResult> => {
+            captured.params = params;
+            return { Success: true, Results: [], RowCount: 0, TotalRowCount: 0, ErrorMessage: '' } as RunViewResult;
+        },
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeUser = () => ({ Email: 'tester@example.com' } as UserInfo);
+const fakePayload = () => ({ email: 'tester@example.com', userRecord: fakeUser() } as UserPayload);
+
+/** Reaches the protected boundary screen and the dynamic-view entry point. */
+class Probe extends ResolverBase {
+    public ScreenClause(clause: string, label: string, provider: DatabaseProviderBase): void {
+        this.assertClientClauseUsesEntityBaseViews(clause, label, provider as unknown as IMetadataProvider);
+    }
+
+    public RunDynamic(input: RunDynamicViewInput, provider: DatabaseProviderBase) {
+        return this.RunDynamicViewGeneric(input, provider, fakePayload(), undefined as unknown as PubSubEngine);
+    }
+}
+
+describe('ResolverBase boundary screen — a client filter must be one balanced expression', () => {
+    const provider = () => fakeProvider({ params: null });
+
+    // Each of these closes the parentheses the provider wraps the fragment in. All of them parse
+    // once the screen adds its own `(` … `)`, which is why the screen must check them standalone.
+    const escapes = [
+        '1=1) OR (1=1',
+        "Name = 'a') OR (Name = 'b'",
+        "[Name] = 'a') OR ([Name] = 'b'",
+        '(1=1)) OR ((1=1)',
+    ];
+
+    it.each(escapes)('rejects the ExtraFilter %j', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', provider())).toThrow(/parenthesis/);
+    });
+
+    it.each(escapes)('rejects the OverrideExcludeFilter %j', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'OverrideExcludeFilter', provider())).toThrow(/parenthesis/);
+    });
+
+    it('rejects a fragment that leaves a parenthesis open', () => {
+        expect(() => new Probe().ScreenClause('(1=1', 'ExtraFilter', provider())).toThrow();
+    });
+
+    it('allows a balanced filter, including parentheses inside string literals', () => {
+        const p = new Probe();
+        const md = provider();
+        expect(() => p.ScreenClause("(Name = 'a' OR Name = 'b') AND (Name <> 'c')", 'ExtraFilter', md)).not.toThrow();
+        expect(() => p.ScreenClause("Name = 'a) OR (b'", 'ExtraFilter', md)).not.toThrow();
+        expect(() => p.ScreenClause("Name LIKE '%(%'", 'OverrideExcludeFilter', md)).not.toThrow();
+    });
+
+    it('RunDynamicViewGeneric never reaches RunView with an ExtraFilter that closes the wrapper', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, ExtraFilter: '1=1) OR (1=1' } as RunDynamicViewInput;
+
+        await expect(new Probe().RunDynamic(input, fakeProvider(captured))).rejects.toThrow(/parenthesis/);
+        expect(captured.params).toBeNull();
+    });
+
+    it('RunDynamicViewGeneric passes a balanced ExtraFilter through unchanged', async () => {
+        const captured: Captured = { params: null };
+        const input = { EntityName: ENTITY_NAME, ExtraFilter: "Name = 'a' OR Name = 'b'" } as RunDynamicViewInput;
+
+        await new Probe().RunDynamic(input, fakeProvider(captured));
+
+        expect(captured.params?.ExtraFilter).toBe("Name = 'a' OR Name = 'b'");
+    });
+
+    it('rejects a comment', () => {
+        expect(() => new Probe().ScreenClause("Name = 'a' -- note\n", 'ExtraFilter', provider())).toThrow(/comment/);
+        expect(() => new Probe().ScreenClause("Name = 'a' /* note */", 'OrderBy', provider())).toThrow(/comment/);
+    });
+});
+
+describe('ResolverBase boundary screen — backslashes inside quotes', () => {
+    // The screen's parser reads a backslash before a quote inside a plain literal as an escaped
+    // quote; SQL Server and PostgreSQL read the quote as the end of the literal. Text after it can
+    // then be code the engine runs while the parser saw a string, so it escapes the screen's checks.
+    const provider = () => fakeProvider({ params: null });
+
+    it('rejects a filter whose hidden part the parser reads as a string constant', () => {
+        const hidesSelect = "Name = 'a\\' AND 1 = (SELECT 1) AND Name = ' + [b' + [c]";
+        expect(() => new Probe().ScreenClause(hidesSelect, 'ExtraFilter', provider())).toThrow(/backslash/);
+        expect(() => new Probe().ScreenClause(hidesSelect, 'OverrideExcludeFilter', provider())).toThrow(/backslash/);
+    });
+
+    it.each(["Path = 'C:\\temp'", '[a\\b] = 1', '"a\\b" = 1'])('rejects a backslash inside a quoted string or identifier (%#)', (clause) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', provider())).toThrow(/backslash/);
+    });
+
+    it('allows a filter with no backslash inside quotes', () => {
+        expect(() => new Probe().ScreenClause("Path LIKE 'C:/temp%'", 'ExtraFilter', provider())).not.toThrow();
+    });
+});
+
+/** Named so the screen reads clauses with the PostgreSQL dialect, as it does for the real provider. */
+class PostgreSQLDataProviderFake {
+    public Entities = [];
+}
+
+describe('ResolverBase boundary screen — PostgreSQL', () => {
+    const pgProvider = () => new PostgreSQLDataProviderFake() as unknown as DatabaseProviderBase;
+
+    it.each([
+        ['Name = $$x$$', /dollar/],
+        ['Café = 1', /outside ASCII/],
+        ["Name = E'x'\n'y'", /escape string/],
+    ])('rejects what the lexer cannot read the way PostgreSQL does (%#)', (clause, reason) => {
+        expect(() => new Probe().ScreenClause(clause, 'ExtraFilter', pgProvider())).toThrow(reason);
+    });
+
+    it('allows text outside ASCII inside a string literal', () => {
+        expect(() => new Probe().ScreenClause("Name = 'Café'", 'ExtraFilter', pgProvider())).not.toThrow();
+    });
+});